Hacker News Reader

Comment by mkl | Hacker News Reader

Seems to have a confusing lack of "getting started" documentation. On the plus side, I now know what the world's smallest octopus is, so the important stuff is covered!

View on HN

They should probably have it linked in the readme but this is their getting started guide: https://edu.chainguard.dev/open-source/wolfi/wolfi-with-dock...

From my side I'd love to see clear comparison to distroless[1] images, the best info I could find was this Github issue comment[2], although I would expect to find it in https://github.com/wolfi-dev#faq. Or maybe my google-fu failed me :(

[1]: https://github.com/GoogleContainerTools/distroless

[2]: https://github.com/tektoncd/pipeline/issues/5507#issuecommen...

I was (one of) the original creators of the Google Distroless project. The main difference is that Original Distroless uses Debian as the upstream. This is great in many ways, but makes it so stuff outside of Debian is hard to package in.

Wolfi is its own upstream - packages are sourced and built directly from source, without another Linux distro.

The rest of the differences stem from here - we get more control over what we package and how, and are able to more quickly add new versions of packages, or roll out CVE patches.

Do you see any significant changes in comparison to the "gcr.io/distroless/static" image, which is commonly used in Go ecosystem? Thanks for answer btw, really appreciate that.

For static, not really just because there's so little in it. For apps that need CGO there's a benefit as more dependencies are required. CGO apps are broken right now IIUC in distroless/glibc-dynamic because of the Debian glibc bump.

I'm thankful that the important stuff is covered , there is helpful documentation over here btw https://edu.chainguard.dev/open-source/wolfi/overview/

Reply on news.ycombinator.com