Making your Docker images smaller and reducing attack surfaces

Containerized applications are becoming more and more common in production applications of all sorts. They are significantly easier to deploy, provide better repeatability, and can offer some security benefits over other deployment options. One thing I’ve noticed from working with other developers, is that many people don’t know how to create good container images. The biggest problem here is that you have to have a basic understanding of what happens when creating images and understand what the goals are with containerizing.

The Continuation… In a previous episode we looked at a way to solve the problem of running multiple services that might need to talk to each other in a sane way. The solution was to run each service in a Docker container and to put any container from the service that you want exposed on a common network that is accessible via a proxy service. We also came up with a list of three possible proxy services to use and tested them out (as well as we could at the time anyway) and decided on two options to continue experimenting with.

The Problem Have you ever been working on a web application and had to switch to another application. Possibly you need to fix a bug in another application or maybe the first application needs to talk to the second application, it doesn’t really matter but you know that you need to run a second application now. You start to launch the application and you get a nice error message saying that the port is already taken because your organization has standardized on all applications launching on port 8080 and the first application is still running on that port.