Description

Kubernetes drove the transition from VMs to Containers, but Linux distro tooling (package manager & package archives) remained focussed on a full blown OS. Distros didn’t adapt to serve the needs of a containerised SDLC.

Containers are meant to run single-processes in isolation, but package management is built for VMs, leading to bloated containers that increase attack surface for applications and lead to patching overhead for developers.

Minimal containers have become the standard for modern application development.

This talk explores an approach for creating a Debian-inspired distro with a container-first design.

Debian container bloat stems from:

1. Essential packages needed for VMs but not containers - like bash, libc6, perl-base, gcc
2. APT package manager footprint - installs 59 packages
3. Maintainer script dependencies in Debian packages - scripts can require runtimes like perl, python etc

Proposing a new approach:

1. Portable APT replacement implemented in Go
2. Reimplementing maintainer scripts with minimal dependencies
3. Bootstrapping a distro so that only required packages can be installed, no “essentials”

Security and compatibility
The core idea stems from 1. Importance of minimal containers to reduce attack surface while maintaining 2. Compatibility with current debian distro.

Such an approach sets up tooling & packages for minimal container creation but compatibility scope is limited to container lifecycle functionalities only.

Takeaways

Minimal containers help with faster container startup times, reduced memory footprint, smaller attack surface, and improved security

Attendees of this talk would be able to understand:

• Challenges with container creation using tooling from existing distros.
• Ideas for creating tooling for secure and performant base-containers.

Target Audience

Security engineers & platform engineers

• who are responsible for managing vulnerabilities in their container images.
• who want to build & manage golden container images registry

Bio

Abhishek Anand
Co-Founder & CTO @ KoalaLab
Tech entrepreneur building solutions for open source software security.

Prev:

• CTO @ Housing.com : Scaled infra to 13Mn daily traffic.
• Platform engineering @ WhitehatJr : Built a self serve Kubernetes platform.
• YC Alum.