⚡ Shrink authbridge images: UBI9-micro for Envoy variant, distroless for lightweight#324
Conversation
Replace UBI9-minimal (~134 MB) with UBI9-micro (~24 MB) as the runtime base image. Both are glibc-compatible (required by Envoy), but UBI9-micro strips package manager, docs, and other utilities not needed at runtime. Also use --chmod in COPY instructions to avoid a redundant chmod RUN layer that was doubling binary sizes in the layer cache. Image size: 243 MB -> 140 MB (42% reduction). Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
New Dockerfile.light builds a Go-only image without Envoy (~49 MB vs ~140 MB for the Envoy variant). Used for waypoint and proxy-sidecar modes where Envoy is not needed. - authbridge-light: Go binary + UBI9-micro base (49 MB) - authbridge-unified: Go binary + Envoy + UBI9-micro (140 MB) Added authbridge-light to CI build matrix. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
The authbridge binary is statically linked (CGO_ENABLED=0) so it does not need glibc. Use gcr.io/distroless/static-debian12:nonroot (~2 MB) instead of UBI9-micro (~24 MB). Includes CA certificates for HTTPS calls to Keycloak JWKS endpoint. No shell — debug via kubectl logs. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
huang195
changed the title
Add authbridge-envoy to CI matrix pointing to the same Dockerfile as authbridge-unified. Both names are published during the transition period. authbridge-unified is marked deprecated. Image naming going forward: - authbridge-envoy: Envoy + authbridge (envoy-sidecar mode) - authbridge-light: Go binary only (waypoint/proxy-sidecar modes) - authbridge-unified: deprecated alias for authbridge-envoy Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
- Pin ubi9/ubi-micro to sha256:2173487b... (multi-arch manifest) - Pin distroless/static-debian12 to sha256:a9329520... (multi-arch manifest) - Remove redundant chmod in builder stage (COPY --chmod=755 sets final perms) Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
- Pin golang:1.24-alpine to sha256:8bee1901... in both Dockerfiles - Copy CA certificates from Alpine builder into UBI9-micro runtime (UBI9-micro has no package manager and no CA certs by default; needed for HTTPS calls to Keycloak JWKS endpoint) - Update header comment with base-vs-total size breakdown Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
pdettori
left a comment
pdettori
left a comment
There was a problem hiding this comment.
PR shrinks authbridge-unified by 42% (UBI9-micro base), and adds a new authbridge-light image for modes that don't need Envoy (distroless, 29 MB). Both images properly pin builder and runtime base images to SHA digests, CA certificates are handled correctly for each base type, and all 17 CI checks pass.
Minor nit: 5 of 6 commits are missing an emoji prefix (only the first commit ⚡ follows the pattern). Not blocking, but worth noting for convention consistency.
Areas reviewed: Dockerfile, CI/GitHub Actions, Security
Commits: 6 commits, all signed-off ✅
CI status: All passing ✅
|
|
||
| # Unified AuthBridge binary (Envoy + authbridge in one container) | ||
| # Drop-in replacement for envoy-with-processor | ||
| # DEPRECATED: use authbridge-envoy instead |
There was a problem hiding this comment.
authbridge-unified is deprecated here but will keep getting built until explicitly removed. Consider adding a comment referencing a follow-up issue (e.g. # TODO: remove in vX.Y — track in #NNN) so this doesn't get forgotten.
| COPY cmd/authbridge/entrypoint.sh /usr/local/bin/entrypoint.sh | ||
| # Stage 3: Runtime — UBI9-micro (glibc-compatible, ~24 MB) | ||
| # UBI9-micro has no package manager and no CA certificates. | ||
| # CA certs are copied from the Alpine builder for HTTPS (JWKS, Keycloak). |
There was a problem hiding this comment.
Nice — copying CA certs from the Alpine builder is the correct way to handle UBI9-micro (no microdnf, no CA bundle pre-installed). The inline comment explaining why makes this easy to understand later.
| RUN cd cmd/authbridge && CGO_ENABLED=0 GOOS=linux go build -o /authbridge . | ||
|
|
||
| # Stage 2: Runtime — distroless static (~2 MB, includes CA certs) | ||
| FROM gcr.io/distroless/static-debian12:nonroot@sha256:a9329520abc449e3b14d5bc3a6ffae065bdde0f02667fa10880c49b35c109fd1 |
There was a problem hiding this comment.
Good choice of distroless/static-debian12:nonroot — statically linked binary, non-root by default from the image tag, and CA certs are included in the static variant. No explicit COPY needed.
github-project-automation
Bot
moved this from Backlog
to Done
in Kagenti Issue Prioritization
3 participants
Summary
authbridge-unified(Envoy variant) from UBI9-minimal to UBI9-micro baseauthbridge-lightimage for waypoint/proxy-sidecar modes using distroless baseauthbridge-lightto CI build matrixImage sizes
authbridge-unified(Envoy + authbridge)authbridge-light(Go binary only)Why two images
The unified image bundles Envoy (~87 MB) which is only needed for envoy-sidecar mode. Waypoint and proxy-sidecar modes run pure Go listeners and pay the full image cost for nothing. The lightweight image eliminates Envoy and uses a distroless base (~2 MB) since the Go binary is statically linked.
Details
authbridge-unified (Envoy variant)
COPY --chmodto avoid redundant chmod layerauthbridge-light (new)
gcr.io/distroless/static-debian12:nonroot(~2 MB)CGO_ENABLED=0)kubectl logs, notkubectl execTest plan
authbridge-unifiedbuilds and runs (Envoy + authbridge verified)authbridge-lightbuilds and runs (--helpverified)Assisted-By: Claude (Anthropic AI) noreply@anthropic.com