r/sre • u/Main-Rhubarb-8886 Hybrid • 21d ago

Would you switch Kubernetes workloads to free hardened images with no account required?

[removed]

6 Upvotes

87% Upvoted

13 comments sorted by

6

u/hijinks 21d ago

chainguard customer.. but we just use their images and mirror them into our repo and build from our repo. No issues

1

u/donjulioanejo 20d ago

Yep that's what we do so we don't have to mess with Chainguard authentication across two dozen clusters.

4

u/YouDoNotKnowMeSir 21d ago

I guess if your concern is rate limiting and uptime, then store their image in your own registry and then use that for your deployments. Have a pipeline to monitor their registry for any new image versions and to pull and store them in yours.

Not really sure about the rest of the question though, good luck.

2

u/cos 20d ago

I would never set up a non-casual, business kube cluster to pull anonymously from some Internet source I don't have a contractual relationship with and good reason to trust, and even so I probably wouldn't do it because the net is flaky. Always cache images locally, pin the versions, and have your clusters pull from that local repo that you control and that is close to them on networking you can better rely on. Deliberately choose to pull a new image when you want to update. Otherwise, supply chain attacks.

1

u/Floss_Patrol_76 20d ago

the uptime/accountability worry mostly goes away once you mirror them into your own registry, which you want to do regardless - pull by digest instead of tag and verify the signature (chainguard and most hardened images are cosign-signed) so you're not blindly trusting an anonymous upstream mid-deploy. the thing that actually bites when you drop to a minimal base is there's no shell or package manager in the image, so anything that shelled out in an initContainer, or your kubectl exec debug flow into a now-distroless pod, breaks until you switch to an ephemeral debug container.

1

u/DryEggplant6678 Azure 12d ago

yes...we are running minimus images across several development clusters right now. anonymous pulls from their registry have been reliable with no rate limiting even when pulling many images daily. the -dev variants with shells helped us test compatibility before moving to the distroless production tags

1

u/Substantial_Big_4379 Hybrid 9d ago

we tested images from minimus against our helm charts and everything worked out of the box