autumnjolitz/distroless-python

distroless-python 镜像文档

镜像概述

distroless（无发行版）镜像是仅包含运行应用程序所需最小组件的镜像。根据定义，distroless镜像具有更高安全性，因为其包含更少代码和入口点。

distroless-python基于官方https://hub.docker.com/_/python%E6%9E%84%E5%BB%BA%EF%BC%8C%E8%BF%99%E6%84%8F%E5%91%B3%E7%9D%80%E5%BD%93%E5%AE%98%E6%96%B9%E9%95%9C%E5%83%8F%E6%9B%B4%E6%96%B0%E6%97%B6%EF%BC%8C%E9%80%9A%E8%BF%87CI/CD%E6%B5%81%E7%A8%8B%E5%8D%B3%E5%8F%AF%E8%BD%BB%E6%9D%BE%E8%8E%B7%E5%8F%96%E6%9B%B4%E6%96%B0%E5%92%8C%E4%BF%AE%E5%A4%8D%E3%80%82

镜像大小对比

bash
$ docker images | grep -E \
>   '^(REPO|gcr.io/distroless/python3|autumnjolitz/distroless-python|python)' | \
>   grep -E 'REPO|latest|3.12-alpine3.20' | sort
REPOSITORY                       TAG                IMAGE ID       CREATED         SIZE
autumnjolitz/distroless-python   3.12-alpine3.20    4a335b955cb1   54 years ago    27.8MB
gcr.io/distroless/python3        latest             e83c6b1e2ef3   N/A             52.8MB
python                           3.12-alpine3.20    2ec26f9329f2   5 days ago      55.3MB

可用镜像标签

DockerHub

• 3.12-alpine3.20
• 3.11-alpine3.20
• 3.10-alpine3.20
• 3.9-alpine3.20
• 3.8-alpine3.20

GitHub Container Repository

• ghcr.io/autumnjolitz/distroless-python:3.12-alpine3.20
• ghcr.io/autumnjolitz/distroless-python:3.11-alpine3.20
• ghcr.io/autumnjolitz/distroless-python:3.10-alpine3.20
• ghcr.io/autumnjolitz/distroless-python:3.9-alpine3.20
• ghcr.io/autumnjolitz/distroless-python:3.8-alpine3.20

核心功能与特性

distroless-python镜像包含以下核心组件：

• python3
• dash
• ca-certificates（注意：使用update-ca-certificates命令更新证书）

优化措施

• 标准库已字节编译并压缩为zip文件，由解释器导入以节省空间
• ensurepip被替换为无操作（no-op），确保venv功能正常

开发与使用方法

每个镜像都有对应的**-buildroot** companion包。可在Dockerfile中使用FROM $SOURCE-buildroot AS builder，并将内容添加到$BUILD_ROOT下的新根目录。

示例：安装PyPI包（httpie）

Dockerfile

dockerfile
#syntax=docker/dockerfile:1
FROM autumnjolitz/distroless-python:3.12-alpine3.20-buildroot AS buildroot
RUN python -m pip install \
        --no-cache \
        --prefix "$BUILD_ROOT/usr/local" \
        httpie

FROM autumnjolitz/distroless-python:3.12-alpine3.20
COPY --from=buildroot \
    /$BUILD_ROOT/usr/local/lib/python$PYTHON_VERSION/site-packages \
    /usr/local/lib/python$PYTHON_VERSION/site-packages
COPY --from=buildroot \
    /$BUILD_ROOT/usr/local/bin/http \
    /usr/local/bin/http

ENTRYPOINT ["http"]

构建与测试

bash
# 构建镜像
$ docker build -t httpie -f Dockerfile .

# 运行测试
$ docker run --rm -it httpie pie.dev/get
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Encoding: gzip
Content-Type: application/json
Date: Sat, 03 Aug 2024 07:00:04 GMT
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400

{
    "args": {},
    "headers": {
        "Accept": "*/*",
        "Accept-Encoding": "gzip",
        "Connection": "Keep-Alive",
        "Host": "pie.dev",
        "User-Agent": "HTTPie/3.2.3"
    },
    "origin": "[suppressed]",
    "url": "http://pie.dev/get"
}

# 查看镜像大小
$ docker images httpie
REPOSITORY   TAG       IMAGE ID       CREATED         SIZE
httpie       latest    7c6811df800d   3 minutes ago   43.3MB

更多示例

参见https://github.com/autumnjolitz/distroless-python/blob/main/examples/simple-flask

相关链接

• 源码: https://github.com/autumnjolitz/distroless-python
• 问题反馈: https://github.com/autumnjolitz/distroless-python/issues
• DockerHub: https://hub.docker.com/r/autumnjolitz/distroless-python