Looks like Nix could be great for this. Here's a blog post with an example: https://mitchellh.com/writing/nix-with-dockerfiles Of course, the trade-off is having to learn at least the basics of Nix, but look like a great investment considering the advantages.
Docker
Oh wow. I didn't realize that Nix containers built from scratch
. That's exactly what I wanted (minus having to learn Nix, but that's not too bad, honestly).
Never mind. While Nix containers do get you the small image sizes and predictable builds you want, nix
, the package manager, is basically broken on macOS.
I use Linux, where nix
seems to work totally fine, but the other people I'm working with use macOS, so I can't ask them to install something that won't work to produce images correctly.
I think I'm going to have to build the minimizer I was thinking of.
I feel like at this point you should just build statically linked binaries, but I suppose there are cases where that's not going to be possible. Anyhow, I've never seen anything like that.
Yeah. Statically-linked binaries are awesome, but many of the utilities that I need to run would require lots of changes to the source to make it happen.
We have Kubler which makes Gentoo -based images. It does a great job of enabling you to toggle dependencies that you need and building a slim, hardened image.
Edit: ldd
sucks, try libtree
instead.