Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issues with Alpine and DNS in Kubernetes #1526

Closed
anton-johansson opened this issue Aug 19, 2019 · 4 comments

Comments

@anton-johansson
Copy link

commented Aug 19, 2019

We've experienced some issues with Alpine and DNS-lookups in Kubernetes. I'm not sure exactly where the problem lies, but some DNS-lookups are really slow (and is a multiple of 2,5, indicating some sort of timeout that is being hit).

Some info can be found here:
gliderlabs/docker-alpine#255

As this seems to be a general problem for Alpine, it affects a lot of our containers. Dex is one of them. Is it possible to build Dex with another image as the base?

Or maybe someone knows a workaround that can be used?

We have a quite low refresh time (5 minute), so an LDAP call is called every 5 minutes when working with Kubernetes. This LDAP call is slow due to the slow DNS lookup.

@srenatus

This comment has been minimized.

Copy link
Collaborator

commented Aug 20, 2019

Is it possible to build Dex with another image as the base?

Which one would you prefer? Would, say, using this https://github.com/GoogleContainerTools/distroless/blob/master/base/README.md resolve the issue?

@anton-johansson

This comment has been minimized.

Copy link
Author

commented Aug 21, 2019

I'm not sure actually, I'm still trying to grasp the actual problem. We'd still want a small image, of course.

The distroless looks interesting. Also, can it run from scratch? The fact that it uses Alpines DNS makes me think it cannot run from scratch? I'm not too good with these things yet, so I can't really say.

Looking at the Dockerfile, it looks like we need ca-certificates and openssl which seems hard to get with scratch.

The distroless static seems to have ca-certificates and the distroless base (which also contains all packages from static) has openssl, so it looks like a great candidate. I'll try to build it locally and see if it works.

@bonifaido

This comment has been minimized.

Copy link
Collaborator

commented Aug 21, 2019

If using scratch you need to copy the ca-certificate from the previous multi-stage build and create a static binary from Dex (if it is not static today) with CGO_ENABLED=0 so all libs will be linked statically.

We do it like this here: https://github.com/banzaicloud/pipeline/blob/master/Dockerfile#L39

@anton-johansson

This comment has been minimized.

Copy link
Author

commented Aug 21, 2019

Okay, so I successfully built Dex with Google's distroless as its base. However, I'm still seeing issues with my DNS lookups. In other words, the issues I'm having is unrelated to the Alpine issue above, and there's probably an issue in my Kubernetes cluster.

I'm closing this for now, but let me know if you want me to publish a pull request for the distroless anyway. I think it has its benefits, even if it didn't solve my issue. :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
3 participants
You can’t perform that action at this time.