Make the container image smaller

[thockin]

For each package and binary we need, this pulls in all the files and deps (shared libs, mostly). The build is slower but the final image is 85 MB (versus 157 MB before). e2e passes.

This is based on scripts used in kubernetes and KinD.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: thockin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [thockin]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[BenTheElder]

one nit :-)

[BenTheElder]

nit: I can't really tell from this comment and the usage context why this is needed. At the call site it's also not obvious what's happening without going back and reading this.

[thockin]

grep treats "no match" as an error, which trips up pipefail and errexit

$ echo foo | grep bar; echo $?
1

So we want to do:

$ echo foo | { grep bar || true; }; echo $?
0

Adding back the comments in the style of binary_to_libraries():

$ echo foo \
    `# comment1` \
    | { grep "bar" || true; } \
    `# comment2`; echo $?
bash: syntax error near unexpected token ``# comment2`'

Parens fails the same way.

It works without the braces and || true, but returns error status

$ echo foo     `# comment1`     | grep "bar"     `# comment2`; echo $?
1

Once bash parses {} or () it can't handle subsequent #comment blocks. happy() hides that. I could rename it :)

[BenTheElder]

grep treats "no match" as an error, which trips up pipefail and errexit

instead of swallowing all errors, you can actually detect the no-match case and ignore that

https://github.com/kubernetes-sigs/kind/blob/2e6414694724a44803caff801eeee2b62a5b6765/images/base/files/usr/local/bin/entrypoint#L41-L44

[BenTheElder]

grep_allow_nomatch() {
  # grep exits 0 on match, 1 on no match, 2 on error
  grep "$@" || [ $? = 1 ]
}

[thockin]

cute, I guess I should actually read the man page :)

[thockin]

PTAL. I want to run a scanner against it to be sure it works, when I get a moment

[BenTheElder]

For each package and binary we need, this pulls in all the files and deps (shared libs, mostly). The build is slower but the final image is 85 MB (versus 157 MB before). e2e passes.

And hopefully less CVEs.

[BenTheElder]

/lgtm