Hacker News
points by craftkiller 1 day ago | 0 comments
Neat project. One thing I don't see covered: is everything going to be statically linked like it is on Alpine Linux? Is statically linking libc advisable on a NetBSD kernel? I know (unlike Linux) the FreeBSD kernel ABI can change every major release, but I'm not familiar with NetBSD's approach.
[–] Intralexical 1 day ago
Alpine Linux is not statically linked. It provides a musl environment which makes it easy to statically link your own builds, but software shipped as part of the distro is usually dynamically linked.

  $ docker run -it --rm alpine

  / # apk add cmd:ldd
  / # ldd $(which ash)
          /lib/ld-musl-x86_64.so.1 (0x7f4cb4d1d000)
          libc.musl-x86_64.so.1 => /lib/ld-musl-x86_64.so.1 (0x7f4cb4d1d000)

  / # apk add cmd:python3
  / # ldd $(which python3)
          /lib/ld-musl-x86_64.so.1 (0x7fd630cab000)
          libpython3.12.so.1.0 => /usr/lib/libpython3.12.so.1.0 (0x7fd63069a000)
          libc.musl-x86_64.so.1 => /lib/ld-musl-x86_64.so.1 (0x7fd630cab000)
[–] craftkiller 1 day ago
Woah, TIL! My Alpine Linux world view has just been shattered. Static linking was frankly *the* selling point of Alpine Linux for me and it turns out I was just plain wrong.
[–] 0x457 1 day ago
Alpine selling point was that it's small, which was selling people only for people that either don't understand docker layers or can't make Dockerfile correctly.

Alpine’s connection to static linking is mainly that it provides a convenient musl build environment. A fully static binary can run in `FROM scratch`.

[–] craftkiller 1 day ago
> A fully static binary can run in `FROM scratch`.

Not just `FROM scratch` but also in other contexts. For example:

I wrote my own password manager which lives on a USB drive. Since I compiled a static binary, I can execute it on any Linux machine.

Running static binaries in FreeBSD's Linuxulator is easier. The Linuxulator is a separate set of syscalls that get used when you attempt to run a Linux binary, so a static binary will "just work" for the most part (unless the program needs special filesystems like /proc or /sys). A dynamically linked binary means I need to make sure I have any necessary Linux libraries in the proper location and the Linuxulator's `ld` working properly. Updates to these libraries can then make something that used to work, suddenly stop working. Certainly not an insurmountable task, but there's so many fewer places where things can break when you're just running a static binary.

[–] 0x457 1 day ago
Well, `FROM scratch` implies that if there is something that works with linux syscalls (i.e. Linuxulator) then it generally runs. Unless, like you said, it needs special filesystems.
[–] yjftsjthsd-h 1 day ago
> which was selling people only for people that either don't understand docker layers or can't make Dockerfile correctly.

I don't think that's fair. Alpine-derived images are generally smaller, all things held equal. Of course if you do everything else right then it will matter less, but a proper multistage Dockerfile should still be smaller than the same thing built out of another distro (most of the time).

[–] zbentley 1 day ago
> which was selling people only for people that either don't understand docker layers or can't make Dockerfile correctly.

...or people who had a test/deploy/debug cycle on environments that necessarily had no layer cache (ephemeral VMs, one-shot kubernetes clusters, OpenWRT routers that lost the layer cache on reboot). Or people with network-constrained traffic from registries or mirrors thereof.

Or people in environments that took container security findings (perhaps too) seriously and were tired of triaging endless reports for random dependencies in "FROM ubuntu" containers, and wanted a default required-by-policy base image that didn't come with the world.

Or people who needed a relatively full-featured build environment against musl without having to do bizarre incantations in e.g. a Fedora image to switch away from libc while still being able to link against other system libraries.

[–] 0x457 14 hours ago
> people who needed a relatively full-featured build environment against musl

Yeah, I called this out as the main appeal of alpine. IMO no one should be using musl, but its another story.

> or people who had a test/deploy/debug cycle on environments that necessarily had no layer cache (ephemeral VMs, one-shot kubernetes clusters, OpenWRT routers that lost the layer cache on reboot). Or people with network-constrained traffic from registries or mirrors thereof.

Debian slim is ~30 MB compressed, and distroless/static is ~2 MiB. Small images aren’t unique to Alpine. With a fast local mirror, the extra download is negligible.

> Or people in environments that took container security findings (perhaps too) seriously and were tired of triaging endless reports for random dependencies in "FROM ubuntu" containers, and wanted a default required-by-policy base image that didn't come with the world.

1) Nobody’s forcing you to use a full Ubuntu image.

2) Alpine images still get plenty of security findings, often in the same dependencies your application needs regardless of the base image.

3) Nix is the best container builder anyway.

[–] zbentley 10 hours ago
You're not wrong, but both "nobody should be using musl" and "nobody's forcing you to use a full-fat distro image" often run into the reality that the choice of base image, security posture, and libc/linkage environment for distributables are, by policy or technical requirements imposed by third parties, not under the control of the person who is trying to make Docker images behave.
[–] rjsw 1 day ago
NetBSD retains the old ABI as well if anything changes to a syscall.