Docker on Besterry — Linux & DevOps Notes

Reducing Container Image Size: Multi-Stage Builds and Alpine

Mon, 20 May 2024 00:00:00 +0000

Small images boot faster, save bandwidth, and have smaller attack surface. Here are the techniques that actually work.

Multi-stage builds

The single biggest win. Build in one stage, copy only the artifacts to a minimal runtime stage. A Go binary of 15 MB ends up in a 17 MB image. Compare to a naive golang:1.22 image at 900+ MB.

Base image choice

From smallest to largest for Go/Rust static binaries:

Docker Network Debugging: nsenter and tcpdump Patterns

Wed, 20 Mar 2024 00:00:00 +0000

When a container cannot reach something, the instinct is often to exec into it and curl. But most slim containers lack curl, dig, tcpdump, or even ping. A better pattern: use nsenter from the host.

Enter the container network namespace

Get the container PID:

docker inspect -f '{{.State.Pid}}' myapp

Then:

sudo nsenter -t PID -n bash

You are now in the container network namespace, but with the host binaries. tcpdump, ip, ss, dig — all work.