[SYSE-359]: Experiment with distroless/base as docker base image

[asutosh]

User description

Description

Experimental: Trying to see if we could replace the current base image with distroless/base (which has glibc)

Related Issue

SYSE-359

---

Type

enhancement

---

Description

• Introduced multi-stage Docker builds across various Dockerfiles to optimize image sizes and security.
• Transitioned to using debian:12-slim and gcr.io/distroless/base-debian12 for a more minimal and secure base.
• Updated Docker configurations and Dockerfiles to enhance the setup for Python plugins and other services.
• Improved Dockerfile readability and maintenance by removing outdated commands and comments.

---

Changes walkthrough

	Relevant files
Enhancement	test.sh Optimize Docker Setup in Test Script                                          ci/tests/python-plugins/test.sh Commented out the docker pull command to potentially speed up setup. +1/-1      Dockerfile.std Implement Multi-Stage Build with Distroless Base                  ci/Dockerfile.std Switched from debian:bookworm-slim to a multi-stage build using debian:12-slim and gcr.io/distroless/base-debian12. Removed unnecessary package removal and cache cleanup commands. Simplified the Dockerfile by removing comments and unused COPY commands. +5/-21    Dockerfile Refactor Dockerfile for Python Plugin Extension                    ci/tests/python-plugins/extend-python/Dockerfile Introduced a multi-stage build to separate the Tyk setup from the Debian base image. Added commands to install Python dependencies. +8/-2      Dockerfile Update Base Image and Commands in Dockerfile                          ci/tests/python-plugins/src/Dockerfile Switched to using busybox:stable-glibc for base utilities. Updated the ENTRYPOINT and CMD to use httpd instead of busybox. +7/-3
Configuration changes	docker-compose.yml Update Docker Compose Configuration                                            ci/tests/python-plugins/docker-compose.yml Added a new build argument DEBIAN_BASE to specify the Debian base image. +1/-0
Documentation	README.md Minor README Update                                                                            ci/tests/python-plugins/extend-python/README.md Minor formatting fix to maintain the integrity of the document. +1/-1

---

✨ PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

[github-actions]

API Changes

no api changes detected

[github-actions]

PR Description updated to latest commit (8588295)

[github-actions]

PR Review

⏱️ Estimated effort to review [1-5]	3, because the PR involves multiple Dockerfiles and a shell script with significant changes, including the introduction of multi-stage builds and changes to the base images. Understanding the impact of these changes on the build process and final Docker image requires a good understanding of Docker and the project's specific requirements.
🧪 Relevant tests	No
🔍 Possible issues	Possible Bug: In ci/tests/python-plugins/extend-python/Dockerfile, the installation of Python packages does not include a cleanup step. This can leave unnecessary files in the image, increasing its size.
	Dependency Management: The PR changes base images in Dockerfiles which might introduce compatibility issues with existing dependencies or software being installed.
🔒 Security concerns	No

Code feedback:

---

relevant file	ci/tests/python-plugins/extend-python/Dockerfile
suggestion	Consider adding cleanup commands after installing packages to reduce the Docker image size. This can be done by appending && apt-get clean && rm -rf /var/lib/apt/lists/* to the RUN apt-get install command. [important]
relevant line	RUN apt-get install -y python3-setuptools libpython3-dev python3-dev python3-grpcio

---

relevant file	ci/tests/python-plugins/test.sh
suggestion	Ensure that commenting out the docker pull command does not affect the availability of the latest Docker images in environments where caching is not aggressive. If this change leads to using outdated images, consider adding a conditional check to pull images when necessary. [medium]
relevant line	#docker pull -q $GATEWAY_IMAGE

---

relevant file	ci/Dockerfile.std
suggestion	To further optimize the Docker image size and security, consider removing unnecessary files and packages after the installation. This can be done by adding a cleanup step similar to the one removed in the PR. [important]
relevant line	RUN dpkg -i /tyk-gateway*${TARGETARCH}.deb

---

relevant file	ci/tests/python-plugins/src/Dockerfile
suggestion	Verify that the new base image busybox:stable-glibc provides all the necessary binaries and dependencies required by the application. If certain utilities or libraries are missing, consider adding them explicitly. [important]
relevant line	FROM busybox:stable-glibc as BB

---

---

✨ Review tool usage guide:

---

Overview:
The review tool scans the PR code changes, and generates a PR review which includes several types of feedbacks, such as possible PR issues, security threats and relevant test in the PR. More feedbacks can be added by configuring the tool.

The tool can be triggered automatically every time a new PR is opened, or can be invoked manually by commenting on any PR.

• When commenting, to edit configurations related to the review tool (pr_reviewer section), use the following template:

/review --pr_reviewer.some_config1=... --pr_reviewer.some_config2=...

• With a configuration file, use the following template:

[pr_reviewer]
some_config1=...
some_config2=...

See the review usage page for a comprehensive guide on using this tool.

[github-actions]

PR Code Suggestions

Category	Suggestions
Best practice	Improve security and reduce image size by cleaning up after package installation. Consider cleaning up the Debian image to reduce the security vulnerabilities and unnecessary files after package installation. This can be done by adding cleanup commands after the dpkg installation. ci/Dockerfile.std [7] -RUN dpkg -i /tyk-gateway*${TARGETARCH}.deb +RUN dpkg -i /tyk-gateway*${TARGETARCH}.deb && apt-get clean && rm -rf /var/lib/apt/lists/*
	Reduce Docker image size and enhance security by cleaning up after package installations. It's recommended to clean up the apt cache and unnecessary files after installing packages to reduce the Docker image size and potential security vulnerabilities. ci/tests/python-plugins/extend-python/Dockerfile [9] -RUN apt-get install -y python3-setuptools libpython3-dev python3-dev python3-grpcio +RUN apt-get install -y python3-setuptools libpython3-dev python3-dev python3-grpcio && apt-get clean && rm -rf /var/lib/apt/lists/*
Maintainability	Standardize the use of base image across Docker configurations by using environment variables. Ensure that the DEBIAN_BASE environment variable is used consistently across all services if intended to standardize the base image across your Docker configurations. ci/tests/python-plugins/docker-compose.yml [25] -- DEBIAN_BASE=debian:12-slim +- DEBIAN_BASE=${DEBIAN_BASE:-"debian:12-slim"}
Performance	Optimize Docker image size and security by selectively copying necessary binaries in a multi-stage build. Consider using a multi-stage build to only copy necessary binaries from busybox to reduce the final image size and potential attack surface. ci/tests/python-plugins/src/Dockerfile [6-8] +FROM busybox:stable-glibc as BB +FROM ${BASE_IMAGE} COPY --from=BB /bin/sh /bin/sh COPY --from=BB /bin/rm /bin/rm COPY --from=BB /bin/httpd /bin/httpd
Reliability	Enhance reliability and error handling by checking the success of Docker image pulls. Ensure that the docker pull command checks for errors and handles them appropriately, possibly logging or retrying the pull. ci/tests/python-plugins/test.sh [10] -#docker pull -q $GATEWAY_IMAGE +docker pull -q $GATEWAY_IMAGE || { echo "Failed to pull image"; exit 1; }

---

✨ Improve tool usage guide:

---

Overview:
The improve tool scans the PR code changes, and automatically generates suggestions for improving the PR code. The tool can be triggered automatically every time a new PR is opened, or can be invoked manually by commenting on a PR.

• When commenting, to edit configurations related to the improve tool (pr_code_suggestions section), use the following template:

/improve --pr_code_suggestions.some_config1=... --pr_code_suggestions.some_config2=...

• With a configuration file, use the following template:

[pr_code_suggestions]
some_config1=...
some_config2=...

See the improve usage page for a comprehensive guide on using this tool.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud