[Feature] No SSL variant of gcr.io/distroless/cc

[charlieegan3]

Hi, we use distroless images in our open source project OPA. The project uses CGO, and our binaries are linked against glibc.

While we don't use the openssl binaries in the images, they appear in our user's security audits and automated scans, which they then report to us. If we can, it'd be nice to use a base image without openssl binaries to reduce alarm.

I was looking into the matter in December and noticed that there was a new nossl flavour of the base image that's now been merged (#1201). Would the project be interested in a nossl glibc variant? I'd be willing to help but my bazel experience close to 0 😄

[dlorenc]

If you're up for it, the images at cgr.dev/chainguiard/glibc-dynamic should be roughly what you're looking for here: https://github.com/chainguard-images/images/blob/main/images/glibc-dynamic/configs/latest.apko.yaml

[charlieegan3]

Thanks Dan for the suggestion. We also ship a -debug version of our images which are based on distroless debug images containing a busybox shell. We'd need to maintain that channel I think with if we are to make this change.

[dlorenc]

Thanks Dan for the suggestion. We also ship a -debug version of our images which are based on distroless debug images containing a busybox shell. We'd need to maintain that channel I think with if we are to make this change.

FWIW that's pretty easy on our end, we can add debug variants with a single yaml file if you want! We do something similar with our PHP images, where the default tags have no shell or package manager but then we have a -dev variant with busybox and a pcakage manager: https://github.com/chainguard-images/images/blob/main/images/php/configs/latest-dev.apko.yaml#L9

[loosebazooka]

yeah I think we can do this, it'll be a bit slow as I'm currently on leave. I don't see a strong reason why the chainguard images wouldn't work for you (the only potential problem I can think of is glibc version compatibility -- you'd have to have build infra that is compatible with your runtime images).

[charlieegan3]

Thanks both! 😊 good to know we have some options. If you're interested @dlorenc and have the bandwidth that would be really helpful. I've dropped you a message.

[lcmgh]

Hi! I was also surprised that there is no cc variant without ssl. I'd like to stick to Google's images due to the trust factor.

[Sineaggi]

Unless I'm mistaken, the java base images also don't need openssl as java ships its own crypto libraries.