distroless-python 镜像文档

镜像概述

distroless（无发行版）镜像是仅包含运行应用程序所需最小组件的镜像。根据定义，distroless镜像具有更高安全性，因为其包含更少代码和入口点。

distroless-python基于官方DockerHub Python镜像构建，这意味着当官方镜像更新时，通过CI/CD流程即可轻松获取更新和修复。

镜像大小对比

$ docker images | grep -E \
>   '^(REPO|gcr.io/distroless/python3|autumnjolitz/distroless-python|python)' | \
>   grep -E 'REPO|latest|3.12-alpine3.20' | sort
REPOSITORY                       TAG                IMAGE ID       CREATED         SIZE
autumnjolitz/distroless-python   3.12-alpine3.20    4a335b955cb1   54 years ago    27.8MB
gcr.io/distroless/python3        latest             e83c6b1e2ef3   N/A             52.8MB
python                           3.12-alpine3.20    2ec26f9329f2   5 days ago      55.3MB

可用镜像标签

DockerHub

• 3.12-alpine3.20
• 3.11-alpine3.20
• 3.10-alpine3.20
• 3.9-alpine3.20
• 3.8-alpine3.20

GitHub Container Repository

• ghcr.io/autumnjolitz/distroless-python:3.12-alpine3.20
• ghcr.io/autumnjolitz/distroless-python:3.11-alpine3.20
• ghcr.io/autumnjolitz/distroless-python:3.10-alpine3.20
• ghcr.io/autumnjolitz/distroless-python:3.9-alpine3.20
• ghcr.io/autumnjolitz/distroless-python:3.8-alpine3.20

核心功能与特性

distroless-python镜像包含以下核心组件：

• python3
• dash
• ca-certificates（注意：使用update-ca-certificates命令更新证书）

优化措施

• 标准库已字节编译并压缩为zip文件，由解释器导入以节省空间
• ensurepip被替换为无操作（no-op），确保venv功能正常

开发与使用方法

每个镜像都有对应的**-buildroot** companion包。可在Dockerfile中使用FROM $SOURCE-buildroot AS builder，并将内容添加到$BUILD_ROOT下的新根目录。

示例：安装PyPI包（httpie）

Dockerfile

#syntax=docker/dockerfile:1
FROM autumnjolitz/distroless-python:3.12-alpine3.20-buildroot AS buildroot
RUN python -m pip install \
        --no-cache \
        --prefix "$BUILD_ROOT/usr/local" \
        httpie

FROM autumnjolitz/distroless-python:3.12-alpine3.20
COPY --from=buildroot \
    /$BUILD_ROOT/usr/local/lib/python$PYTHON_VERSION/site-packages \
    /usr/local/lib/python$PYTHON_VERSION/site-packages
COPY --from=buildroot \
    /$BUILD_ROOT/usr/local/bin/http \
    /usr/local/bin/http

ENTRYPOINT ["http"]

构建与测试

# 构建镜像
$ docker build -t httpie -f Dockerfile .

# 运行测试
$ docker run --rm -it httpie pie.dev/get
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Encoding: gzip
Content-Type: application/json
Date: Sat, 03 Aug 2024 07:00:04 GMT
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400

{
    "args": {},
    "headers": {
        "Accept": "*/*",
        "Accept-Encoding": "gzip",
        "Connection": "Keep-Alive",
        "Host": "pie.dev",
        "User-Agent": "HTTPie/3.2.3"
    },
    "origin": "[suppressed]",
    "url": "[***]"
}

# 查看镜像大小
$ docker images httpie
REPOSITORY   TAG       IMAGE ID       CREATED         SIZE
httpie       latest    7c6811df800d   3 minutes ago   43.3MB

更多示例

参见examples/simple-flask/

相关链接

• 源码: [***]
• 问题反馈: [***]
• DockerHub: [***]