starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[PR #214] [MERGED] Using distroless base image for Docker #1326

New Issue
Closed
opened 2025-12-29 02:29:42 +01:00 by adam · 0 comments
adam commented 2025-12-29 02:29:42 +01:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/juanfont/headscale/pull/214
Author: @ItalyPaleAle
Created: 11/7/2021
Status: ✅ Merged
Merged: 11/16/2021
Merged by: @kradalby

Base: main ← Head: docker-distroless

📝 Commits (10+)

  • 3720da6 Using distroless base image for Docker
  • a6d487d Using debian11-based distroless image
  • 6076656 Updated docs
  • 67953bf Fixed integration tests
  • 83e72ec Allow running headscale without leading /
  • 3b34c7b Removed / from docker commands in docs
  • c290ce4 Revert "Fixed integration tests"
  • f44138c Added debug container
  • c0f1660 Copy headscale binary in /bin in the container
  • 7d77acd Docs for debug container

📊 Changes

4 files changed (+124 additions, -24 deletions)

View changed files

📝 .github/workflows/release.yml (+44 -0)
📝 Dockerfile (+4 -9)
➕ Dockerfile.debug (+23 -0)
📝 docs/Running.md (+53 -15)

📄 Description

Thanks for making Headscale!

I have a proposed improvement to the Docker image, switching the base image of the final container from Ubuntu to a "distroless" image, using images from https://github.com/GoogleContainerTools/distroless

If you've never heard of "distroless" images, that page contains a bunch of details on the benefits, but the TL;DR is that these images do not contain a full OS but rather just enough to run the application (ca-certificates, glibc, tzdata, and just a couple more things). By using a "distroless" image, the container is much smaller (they claim they're 2% of the size of a Debian base image) and it's safer, as there's a significantly smaller attack surface. Plus, "distroless" images are updated much less frequently so keeping the base image up-to-date (and include security fixes) is much simpler.

I've confirmed this builds and the headscale binary runs. I haven't performed full E2E tests however just yet.

PS: I've also removed the stage bufbuild/buf:1.0.0-rc6 which seemed unused

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/juanfont/headscale/pull/214 **Author:** [@ItalyPaleAle](https://github.com/ItalyPaleAle) **Created:** 11/7/2021 **Status:** ✅ Merged **Merged:** 11/16/2021 **Merged by:** [@kradalby](https://github.com/kradalby) **Base:** `main` ← **Head:** `docker-distroless` --- ### 📝 Commits (10+) - [`3720da6`](https://github.com/juanfont/headscale/commit/3720da6386759488f7a913b6cc5f75abd7c5b1f1) Using distroless base image for Docker - [`a6d487d`](https://github.com/juanfont/headscale/commit/a6d487de0099d1aaf8dbf05de69028c81c72a2ac) Using debian11-based distroless image - [`6076656`](https://github.com/juanfont/headscale/commit/6076656373e0af6db3948008ea302368cf8eb5d0) Updated docs - [`67953bf`](https://github.com/juanfont/headscale/commit/67953bfe2f54c4231e95d77987eb8f39e3f3fc46) Fixed integration tests - [`83e72ec`](https://github.com/juanfont/headscale/commit/83e72ec57d18227a8ddb0d3a06c8e657bc352549) Allow running headscale without leading / - [`3b34c7b`](https://github.com/juanfont/headscale/commit/3b34c7b89afb240047385dcfef8ace0bc700230a) Removed / from docker commands in docs - [`c290ce4`](https://github.com/juanfont/headscale/commit/c290ce4b91369c809ad6e244df9b500d87d8c18f) Revert "Fixed integration tests" - [`f44138c`](https://github.com/juanfont/headscale/commit/f44138c944c35edf3a6ab8f2b4249992ef9ef96c) Added debug container - [`c0f1660`](https://github.com/juanfont/headscale/commit/c0f16603c5d8656192b9854bf6c80aede3329059) Copy headscale binary in /bin in the container - [`7d77acd`](https://github.com/juanfont/headscale/commit/7d77acd88ea847e8412768fb8b218c7ced2a2b02) Docs for debug container ### 📊 Changes **4 files changed** (+124 additions, -24 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/release.yml` (+44 -0) 📝 `Dockerfile` (+4 -9) ➕ `Dockerfile.debug` (+23 -0) 📝 `docs/Running.md` (+53 -15) </details> ### 📄 Description Thanks for making Headscale! I have a proposed improvement to the Docker image, switching the base image of the final container from Ubuntu to a "distroless" image, using images from https://github.com/GoogleContainerTools/distroless If you've never heard of "distroless" images, that page contains a bunch of details on the benefits, but the TL;DR is that these images do not contain a full OS but rather just enough to run the application (ca-certificates, glibc, tzdata, and just a couple more things). By using a "distroless" image, the container is much smaller (they claim they're 2% of the size of a Debian base image) and it's safer, as there's a significantly smaller attack surface. Plus, "distroless" images are updated much less frequently so keeping the base image up-to-date (and include security fixes) is much simpler. I've confirmed this builds and the `headscale` binary runs. I haven't performed full E2E tests however just yet. PS: I've also removed the stage `bufbuild/buf:1.0.0-rc6` which seemed unused --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2025-12-29 02:29:42 +01:00
adam closed this issue 2025-12-29 02:29:42 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#1326
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?