Hacker News Reader

Comment by mikepurvis | Hacker News Reader

A scratch container doesn't even have busybox in it, does it? If not, this wouldn't be able to run npm, much less install anything which has bindings to other libraries.

Definitely a cute experiment, but probably of limited real-world use. I wonder what the smallest _practical_ node container would look like?

View on HN

`npm` should be included in a final container anyway. Best practices for Docker are to have a separate build and run container. The build container can contain anything you want, but the run container should have only the bare minimum required to execute the artifact produced by the build container.

s/should/shouldn't

Yup, thanks! Typing too quickly. ^^

I suppose you could apply the same builder/scrstch separation as this Dockerfile and install using npm/yarn/etc and copy over the result

It's certainly only practical when every byte matters. At that point it might also make sense to prebundle the dependencies and copy that over.

It'd be interesting to see whether this becomes relevant if serverless-like constraints suddenly apply to a Docker cloud service

wait, do you mean adding another layer for npm installing other deps?

No, doing npm install in a different container and copying over the result. Docker has multi-stage build, which allows using a container to build and copying over in a different result container..

I suspect this could be relevant many place, keeping images small also hardens security.

Oh, what are the advantages of doing that in a different container as opposed to a different layer? Trying to understand the pros/cons.. Isn't it faster to add extra layers, than extra containers?

Different layer means you have to carry around that layer in your final image. If you do a multi-stage build, you can copy over just the bits you need into the final image.

Layers are add only. If you removea file, it still exists in the parent layer, propagating bloat

This is the builder pattern in docker. You do things in one "throw away" container, use results from this container and copy them into another. The final container gets only one layer now, instead of maybe 10s that your "throw away" container had.

That's exactly what the README suggests to do under 'Usage'. First it says 'FROM node', which is the regular 'fat' image. In this image it then runs `npm install`. Further on there is another 'FROM' which starts from the minimal image and copies over all the JS code (including the node_modules directory which has been populated by npm) from the 'fat' image (this of course would fail for bindings that require libraries outside the node_modules directory, although it is relatively easy to add more COPY statements to also put these in the appropriate locations).

Reply on news.ycombinator.com