Skip to content

0001. Alpine Linux as Base Image

Status

Accepted

Context

The dev container needs a Linux base image. The main candidates are:

  • Alpine Linux: ~5 MB base, musl libc, apk package manager.
  • Debian/Ubuntu: ~70-120 MB base, glibc, apt package manager.
  • Distroless: Minimal but lacks shell and package manager entirely.

The container must be minimal and present the smallest possible attack surface. It will run developer tooling (Terraform, Ansible, Chef, etc.), not production workloads, so compatibility with the full glibc ecosystem is a secondary concern.

Decision

Use Alpine Linux (latest stable, pinned by digest) as the base image for both the builder and runtime stages.

Where a tool requires glibc (currently only the 1Password CLI), install the gcompat compatibility shim rather than switching base images.

Consequences

Easier: - Smaller image size (~5 MB base vs ~70 MB) means faster pulls and less storage. - Smaller attack surface: fewer pre-installed packages, fewer CVEs to patch. - apk is fast and supports --no-cache for clean layers.

Harder: - Some tools ship only glibc-linked binaries. Each needs evaluation: - 1Password CLI: works with gcompat. - tflint: must use Alpine community package, not generic release binary. - Python and Ruby must be compiled from source via mise (no precompiled musl binaries). This increases build time (~5-10 minutes) but is cached. - Build dependencies (build-base, openssl-dev, etc.) remain in the final image to allow runtime pip install/gem install with native extensions.