Switch redis:alpine over to su-exec #54

tianon · 2016-04-18T21:06:27Z

After ncopa/su-exec@f85e5bd (su-exec 0.2+), su-exec now has parity with gosu (as verified by gosu's new test suite) such that it's acceptable to use as a gosu replacement in our Alpine-based variant for the size consideration.

After ncopa/su-exec@f85e5bd (`su-exec` 0.2+), `su-exec` now has parity with `gosu` (as verified by `gosu`'s new test suite) such that it's acceptable to use as a `gosu` replacement in our Alpine-based variant for the size consideration.

tianon · 2016-04-18T23:13:27Z

Updated diffs:

diff --git a/3.0/Dockerfile b/3.0/alpine/Dockerfile
index f06713e..2ffcf68 100644
--- a/3.0/Dockerfile
+++ b/3.0/alpine/Dockerfile
@@ -1,43 +1,32 @@
-FROM debian:jessie
+FROM alpine:3.3

 # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
-RUN groupadd -r redis && useradd -r -g redis redis
+RUN addgroup -S redis && adduser -S -G redis redis

-RUN apt-get update && apt-get install -y --no-install-recommends \
-       ca-certificates \
-       wget \
-   && rm -rf /var/lib/apt/lists/*
-
-# grab gosu for easy step-down from root
-ENV GOSU_VERSION 1.7
-RUN set -x \
-   && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
-   && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
-   && export GNUPGHOME="$(mktemp -d)" \
-   && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
-   && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
-   && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
-   && chmod +x /usr/local/bin/gosu \
-   && gosu nobody true
+# grab su-exec for easy step-down from root
+RUN apk add --no-cache 'su-exec>=0.2'

 ENV REDIS_VERSION 3.0.7
 ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-3.0.7.tar.gz
 ENV REDIS_DOWNLOAD_SHA1 e56b4b7e033ae8dbf311f9191cf6fdf3ae974d1c

 # for redis-sentinel see: http://redis.io/topics/sentinel
-RUN buildDeps='gcc libc6-dev make' \
-   && set -x \
-   && apt-get update && apt-get install -y $buildDeps --no-install-recommends \
-   && rm -rf /var/lib/apt/lists/* \
+RUN set -x \
+   && apk add --no-cache --virtual .build-deps \
+       gcc \
+       linux-headers \
+       make \
+       musl-dev \
    && wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL" \
    && echo "$REDIS_DOWNLOAD_SHA1 *redis.tar.gz" | sha1sum -c - \
-   && mkdir -p /usr/src/redis \
-   && tar -xzf redis.tar.gz -C /usr/src/redis --strip-components=1 \
+   && mkdir -p /usr/src \
+   && tar -xzf redis.tar.gz -C /usr/src \
+   && mv "/usr/src/redis-$REDIS_VERSION" /usr/src/redis \
    && rm redis.tar.gz \
    && make -C /usr/src/redis \
    && make -C /usr/src/redis install \
    && rm -r /usr/src/redis \
-   && apt-get purge -y --auto-remove $buildDeps
+   && apk del .build-deps

 RUN mkdir /data && chown redis:redis /data
 VOLUME /data

diff --git a/3.0/docker-entrypoint.sh b/3.0/alpine/docker-entrypoint.sh
index 983b629..2462ffd 100755
--- a/3.0/docker-entrypoint.sh
+++ b/3.0/alpine/docker-entrypoint.sh
@@ -1,10 +1,10 @@
-#!/bin/bash
+#!/bin/sh
 set -e

 # allow the container to be started with `--user`
 if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then
    chown -R redis .
-   exec gosu redis "$BASH_SOURCE" "$@"
+   exec su-exec redis "$0" "$@"
 fi

 exec "$@"

tianon · 2016-04-18T23:38:58Z

Updated again, even slightly smaller diff now:

diff --git a/3.0/Dockerfile b/3.0/alpine/Dockerfile
index f06713e..643caa7 100644
--- a/3.0/Dockerfile
+++ b/3.0/alpine/Dockerfile
@@ -1,34 +1,23 @@
-FROM debian:jessie
+FROM alpine:3.3

 # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
-RUN groupadd -r redis && useradd -r -g redis redis
+RUN addgroup -S redis && adduser -S -G redis redis

-RUN apt-get update && apt-get install -y --no-install-recommends \
-       ca-certificates \
-       wget \
-   && rm -rf /var/lib/apt/lists/*
-
-# grab gosu for easy step-down from root
-ENV GOSU_VERSION 1.7
-RUN set -x \
-   && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
-   && wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
-   && export GNUPGHOME="$(mktemp -d)" \
-   && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 \
-   && gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
-   && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
-   && chmod +x /usr/local/bin/gosu \
-   && gosu nobody true
+# grab su-exec for easy step-down from root
+RUN apk add --no-cache 'su-exec>=0.2'

 ENV REDIS_VERSION 3.0.7
 ENV REDIS_DOWNLOAD_URL http://download.redis.io/releases/redis-3.0.7.tar.gz
 ENV REDIS_DOWNLOAD_SHA1 e56b4b7e033ae8dbf311f9191cf6fdf3ae974d1c

 # for redis-sentinel see: http://redis.io/topics/sentinel
-RUN buildDeps='gcc libc6-dev make' \
-   && set -x \
-   && apt-get update && apt-get install -y $buildDeps --no-install-recommends \
-   && rm -rf /var/lib/apt/lists/* \
+RUN set -x \
+   && apk add --no-cache --virtual .build-deps \
+       gcc \
+       linux-headers \
+       make \
+       musl-dev \
+       tar \
    && wget -O redis.tar.gz "$REDIS_DOWNLOAD_URL" \
    && echo "$REDIS_DOWNLOAD_SHA1 *redis.tar.gz" | sha1sum -c - \
    && mkdir -p /usr/src/redis \
@@ -37,7 +26,7 @@ RUN buildDeps='gcc libc6-dev make' \
    && make -C /usr/src/redis \
    && make -C /usr/src/redis install \
    && rm -r /usr/src/redis \
-   && apt-get purge -y --auto-remove $buildDeps
+   && apk del .build-deps

 RUN mkdir /data && chown redis:redis /data
 VOLUME /data

diff --git a/3.0/docker-entrypoint.sh b/3.0/alpine/docker-entrypoint.sh
index b1a9084..2462ffd 100755
--- a/3.0/docker-entrypoint.sh
+++ b/3.0/alpine/docker-entrypoint.sh
@@ -4,7 +4,7 @@ set -e
 # allow the container to be started with `--user`
 if [ "$1" = 'redis-server' -a "$(id -u)" = '0' ]; then
    chown -R redis .
-   exec gosu redis "$BASH_SOURCE" "$@"
+   exec su-exec redis "$0" "$@"
 fi

 exec "$@"

tianon · 2016-04-18T23:39:48Z

Image size comparison: before ~15.95 MB, after ~13.92 MB

tianon · 2016-04-19T17:07:48Z

Just for completeness, just updating the the new gosu 1.8 is ~15.71 MB (and I just did a fresh build of the repo as-is -- it's actually ~16.6 MB, not the ~15.95 MB I listed above)

So in conclusion:
Savings for using gosu 1.8: ~0.89 MB
Savings for using su-exec 0.2: ~2.68 MB

👍

tianon · 2016-04-19T17:09:08Z

In other words, we're saving roughly 💾 💾

yosifkit · 2016-04-19T17:17:22Z

3.0/docker-entrypoint.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh


Um, $BASH_SOURCE won't work in this file now 😉

Fixed! 😵

yosifkit · 2016-04-19T17:34:02Z

3.0/Dockerfile

-ENTRYPOINT ["/entrypoint.sh"]
+COPY docker-entrypoint.sh /usr/local/bin/
+RUN ln -s usr/local/bin/docker-entrypoint.sh /entrypoint.sh # backwards compat
+ENTRYPOINT ["docker-entrypoint.sh"]


What about 2.8?

LESIGH, fixed ❤️

yosifkit · 2016-04-19T17:38:30Z

LGTM

- `drupal`: 8.1 GA - `mariadb`: add xtrabackup for Galera (MariaDB/mariadb-docker#47) - `pypy`: 5.1.0 - `python`: empty `~/.cache` (docker-library/python#103) - `redis`: use `su-exec` in Alpine variants (redis/docker-library-redis#54) - `rocket.chat`: 0.27.0

Switch redis:alpine over to su-exec

cfa9feb

After ncopa/su-exec@f85e5bd (`su-exec` 0.2+), `su-exec` now has parity with `gosu` (as verified by `gosu`'s new test suite) such that it's acceptable to use as a `gosu` replacement in our Alpine-based variant for the size consideration.

yosifkit reviewed Apr 19, 2016
View reviewed changes

tianon force-pushed the su-exec branch from 5ec0998 to 95d7961 Compare April 19, 2016 17:25

yosifkit reviewed Apr 19, 2016
View reviewed changes

A few more minor tweaks to shrink our Alpine<->Debian diff slightly more

bc3ca85

tianon force-pushed the su-exec branch from 95d7961 to bc3ca85 Compare April 19, 2016 17:35

yosifkit merged commit f6a5854 into redis:master Apr 19, 2016

yosifkit deleted the su-exec branch April 19, 2016 17:38

tianon mentioned this pull request Apr 20, 2016

Update docker-library images docker-library/official-images#1649

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Switch redis:alpine over to su-exec #54

Switch redis:alpine over to su-exec #54

tianon commented Apr 18, 2016

tianon commented Apr 18, 2016

tianon commented Apr 18, 2016

tianon commented Apr 18, 2016

tianon commented Apr 19, 2016

tianon commented Apr 19, 2016

yosifkit Apr 19, 2016

tianon Apr 19, 2016

yosifkit Apr 19, 2016

tianon Apr 19, 2016

yosifkit commented Apr 19, 2016

		@@ -1,4 +1,4 @@
		#!/bin/bash
		#!/bin/sh

Switch redis:alpine over to su-exec #54

Switch redis:alpine over to su-exec #54

Conversation

tianon commented Apr 18, 2016

tianon commented Apr 18, 2016

tianon commented Apr 18, 2016

tianon commented Apr 18, 2016

tianon commented Apr 19, 2016

tianon commented Apr 19, 2016

yosifkit Apr 19, 2016

Choose a reason for hiding this comment

tianon Apr 19, 2016

Choose a reason for hiding this comment

yosifkit Apr 19, 2016

Choose a reason for hiding this comment

tianon Apr 19, 2016

Choose a reason for hiding this comment

yosifkit commented Apr 19, 2016