DEV Community

Cover image for Optimizing Docker Images for Size and Security: A Comprehensive Guide

Optimizing Docker Images for Size and Security: A Comprehensive Guide

Akshat Gautam on August 22, 2024

Docker is a powerful tool that enables developers to containerize their applications and ensure consistency across various environments. However, ...
Collapse
 
denys_bochko profile image
Denys Bochko

Hey.
Nice article in general.
I disagree with you about stages and image size. I don't think what you are comparing is fair since you are using two different web servers: serve vs nginx.

The staged approach provides a way to better organize your dockerfile for better readability and to pull files from other build stages that have already been processed, so it saves time for let's say production deployment. I don't think it's about sizes (and docker documentation does not mention it either).
Your staged approach is doing exactly that, you are building the app in stage one and then injecting it into your nginx container. So, if you need to create another container with let's say httpd server, you can use the same files from stage one, making your deployment faster due to already compiled app.

Your original dockerfile doing the same thing except for the usage of serve server. I just checked nginx-alpine image size is 5Mb i am pretty sure that's much less in space than the installed serve server. Your size has decreased since you are smartly using a much lighter server in a bare image.

Collapse
 
akshat_gautam profile image
Akshat Gautam

Thank you for your feedback and for bringing up these important points!

You’re absolutely right—multi-stage builds are primarily about organizing the Dockerfile for better readability, modularity, and deployment efficiency. However, If used smartly you can also reduce the size of your Docker image.

For instance, I built two images based on the same base image: one using serve and another without it:
Image description

The use of serve created a difference of only ~8 MBs

It's not just about the size difference between serve and nginx; the real impact comes from removing the build environment and keeping only the environment necessary to serve the application. The size reduction from that alone makes the serve vs. nginx difference negligible in comparison.

Ultimately, it depends on the type of application you're containerizing. Spend some time experimenting with different images to find the best setup for your specific needs.

Stay Smart
Happy Learning !

Collapse
 
denys_bochko profile image
Denys Bochko

Absolutely. I am currently primarily dealing with lamp stack images, but shortly will need to do more digging on node and vue containers.
I find that working with compiled apps is more difficult at first because of how the dev env works, but then you learn it and optimize it.

Thread Thread
 
akshat_gautam profile image
Akshat Gautam

Thank you for sharing your experience! I really appreciate your insights. Working with compiled apps is definitely a learning curve. Your guidance is invaluable, and I’m grateful to learn from you. 🙏😊

Thread Thread
Collapse
 
srbhr profile image
Saurabh Rai

Hey @akshat_gautam, this is a nice article. I have a docker image for resume matcher over here that I need some help with. Can you help me with that?
It's open source and used for building resumes.
🔗: github.com/srbhr/Resume-Matcher

Collapse
 
akshat_gautam profile image
Akshat Gautam

Hey @srbhr

Thank you for your words, Glad you liked it !

I just looked the project repo and would love to contribute to it !

Collapse
 
srbhr profile image
Saurabh Rai

💖

Thread Thread
Collapse
 
bobbyiliev profile image
Bobby Iliev

Great article! Well done 👏

If you have the time, feel free to contribute to the open-source Docker ebook:

GitHub logo bobbyiliev / introduction-to-docker-ebook

Free Introduction to Docker eBook

💡 Introduction to Docker

This is an open-source introduction to Docker guide that will help you learn the basics of Docker and how to start using containers for your SysOps, DevOps, and Dev projects. No matter if you are a DevOps/SysOps engineer, developer, or just a Linux enthusiast, you will most likely have to use Docker at some point in your career.

The guide is suitable for anyone working as a developer, system administrator, or a DevOps engineer and wants to learn the basics of Docker.

🚀 Download

To download a copy of the ebook use one of the following links:

📘 Chapters

Collapse
 
akshat_gautam profile image
Akshat Gautam

Thank you so much!
I’m glad you liked the article. I’d love to contribute to the open-source Docker ebook—sounds like a great opportunity! I’ll definitely check it out. 😊

Collapse
 
bobbyiliev profile image
Bobby Iliev

Thanks! I've also pushed your article to Daily.Dev so you could get some extra visibility:

Thread Thread
 
akshat_gautam profile image
Akshat Gautam

Oh that's so nice of yours.

Thank You :)

Collapse
 
chiefy profile image
Christopher "Chief" Najewicz

Important to note if you're going to use Alpine, it uses MUSL vs. GLIBC. Most developers won't care or need to know about this, but depending on what you're doing it can make a difference.
musl-libc.org/faq.html

Collapse
 
akshat_gautam profile image
Akshat Gautam

Yes you said that right, Most developer won't need this as or many basic applications, especially those written in higher-level languages (like Node.js, Python, or Go), the difference between MUSL and GLIBC doesn't matter.

But if you're working with low-level system code, some performance-intensive applications, or specific libraries that expect GLIBC, you may encounter issues with Alpine using MUSL.

Solution: You may need to switch back to a GLIBC-based distribution (like Debian or Ubuntu)

Thanks for the shared information.

Happy Learning !

Collapse
 
martinbaun profile image
Martin Baun

Good job man. I personally use watchtower.
Just make sure there's an environment variable

 WATCHTOWER_CLEANUP 
Enter fullscreen mode Exit fullscreen mode

set to

true 
Enter fullscreen mode Exit fullscreen mode

and it does the cleanup for you.

Collapse
 
akshat_gautam profile image
Akshat Gautam

Thank you for your words, Glad you liked it.

This is a nice piece of information. For anyone not knowing what Watchtower is, it is a tool for automating Docker container updates. Watchtower automatically monitors running containers for image updates and redeploys them if a new version is available. It's commonly used in production to keep containers up to date.

The WATCHTOWER_CLEANUP environment variable being set to true ensures that when Watchtower updates a container, it automatically removes old, unused images that are left behind.

Explore more at Official Docs

Happy Learning !

Collapse
 
thegrumpyopsdude profile image
JB

Solid article!

Collapse
 
akshat_gautam profile image
Akshat Gautam • Edited

Thank you very much @thegrumpyopsdude

Glad you liked it.

Happy Learning !

Collapse
 
jjkaduppil profile image
HighThinker • Edited

Good one!

Collapse
 
akshat_gautam profile image
Akshat Gautam

Thank You, Glad you loved it !

Happy Learning :)