This presentation argues that mainstream container build practices, demonstrated by the failure of systems like Debian/PHP to manage extension dependencies (e.g., PHP GD) efficiently, are inefficient and force users into manual compilation steps. The speaker proposes using Gentoo Linux as a precise, source-based Docker build system, leveraging its "Use Flags" for granular control over application features and dependencies. The core technical challenge addressed is shrinking the resulting massive Gentoo image (~1.4 GB) down to a minimal, deployable size (~70 MB) using strict multi-stage builds, root redirection, and aggressive cleanup of unnecessary utilities and documentation. For debugging these minimal images, the speaker advocates for a pragmatic solution: external debug containers utilizing namespace sharing. The Kubler project is highlighted as the specialized tool that automates and simplifies this complex customization workflow.
Using Gentoo as a Docker Build System: Achieving Minimal and Customized Images
0:02:42 The Inefficient Status Quo: The speaker was deeply annoyed by standard Docker/Debian package management, specifically PHP's failure to install the GD extension without requiring manual collection of library dependencies (libpng, libjpeg-turbo, etc.). As far as I can tell, standard binary package systems often fail when customization is required, forcing developers into unnecessary work.
0:05:09 The Gentoo Solution (Rational Customization): Gentoo's emerge package manager and Use Flags allow precise control over what features are compiled into a package (e.g., enabling use=gd automatically pulls in required dependencies and compilation flags). This avoids bloat and manual dependency management.
0:09:39 Initial Docker Bloat Problem: The initial Gentoo image is prohibitively large (1.39 GB). The speaker cites a personal case where a large image push cost €300 in roaming fees and caused a 20-minute deployment delay. Reject the premise that multi-gigabyte production images are acceptable; they are a direct attack on efficiency and agility.
0:11:31 Build Isolation Difficulty: Attempting to compile PHP into a separate, isolated destination directory (ROOT=/dest) failed because software often has hidden dependencies and relies on absolute paths in the build environment, requiring PHP to be pre-compiled on the host system first.
0:14:08 Hidden Runtime Dependencies: Runtime dependencies, such as required timezone data for proper time handling in PHP, are often undocumented and must be manually included to prevent silent failures in production.
0:15:18 The Multi-Stage Cure: Multi-stage builds are critical for layer squashing. By copying only the essential compiled artifacts from the large Gentoo build stage into a minimal scratch image, the size was reduced from 1.48 GB to 112 MB.
0:17:32 Aggressive Cleanup: Further size reduction (down to 72 MB) was achieved by actively removing unnecessary core OS utilities (like file and set) and documentation/man pages (/usr/shared/docs). I don't care about documentation in a production container, that is just wasted storage.
0:20:00 Debugging Minimal Containers: Minimal containers lacking a shell or tools (ifconfig, strace) should be debugged using a separate "fat" debug container that shares the production container’s namespaces (Network, PID). This separation is necessary and rational.
0:23:46 The Kubler Tool: The Kubler project is recommended as the practical system for managing customized Gentoo builds in containers, simplifying complex build logic (down to ~20 lines of configuration) and achieving highly optimized images (as low as 65 MB).
0:28:06 Key Takeaway (Mandate): Build minimalistic images, implement integration tests to verify functionality (especially when dealing with hidden dependencies), utilize multi-stage builds, aggressively clean up unnecessary operating system artifacts, and always use separate containers for debugging tools.