Any thoughts on the container image?

[prabhu]

Is the container image version of cdxgen useful? Any improvement ideas or issues to resolve?

[prabhu]

@heubeck Any improvements you could think of?

[prabhu]

I think offering multiple java and gradle versions via sdkman is a very good idea! Agree it does blow up the image size so tried to avoid it. Perhaps, we could come up with language specific versions that goes deeper per language like a java version, dotnet version etc?

[heubeck]

pardon me, don't get what you mean with "goes deeper". has broader support?

[prabhu]

Like an image with only multiple java related toolings.

[heubeck]

ahhh, that's interesting.
but would you really like to take care of all those images?
maybe just provide a foundation image and a guide how to adopt it to your needs, or maybe include install scripts into the foundation image, so that everyone just need to

FROM cdxgen-base:latest
RUN install-java.sh 11 17 20
RUN install-android-sdk.sh 10

[prabhu]

That's a good idea too! Thank you so much!

[marcelstoer]

I came here looking for discussions about the usefulness of the Docker image(s). Glad I don't have to start a new thread 😄

The only issue for us is its gigantic size. Here's why.

We are in the process of adding SBOM generation to our GitLab pipeline(s). I started off using the available image - until I realized it's well over 7GB. If you just download it once, it may be bearable. However, on the build nodes we regularly prune the Docker images that our projects pull for building their components. Hence, chances are quite high that the first pipeline that runs in the morning will first have to re-pull the cdxgen image.

Furthermore, upon analyzing the image with dive we noticed it reported a "potential wasted space" of 4GB and "image efficiency score" of only around 75%. I didn't dig deeper yet. However, since all dependencies are installed in a single layer (which is usually good for optimization) it takes as little as a new Java version for the whole layer to change. Updating from 9.8.0 to 9.8.3 effectively meant pulling the whole image again.

What would be helpful for us would be to have one image per language/tech-stack. This would give you Node + Java, Node + PHP, Node + Swift, etc. and maybe aggregated compositions you deem useful.

[prabhu]

@marcelstoer, have you looked into sbom server? There are multiple ways to integrate sbom generation in CI pipelines. However, the model I am a fan of is to run the cdxgen server via a serverless function/cloud run and use a webhook listener to generate sbom over rest asynchronously.

https://github.com/CycloneDX/cdxgen#sbom-server