TL;DR - Is there any way to have apk packages copied/moved to the final distroless image of a multi-stage build?

I apologize if this is not the right platform to ask this question, but I've been trying to find the answer to this for quite some time and I'm unable to find a clear answer but only mixed opinions. So here goes-

I have a multi-stage docker build where the first stage is where I install a few packages using apk (curl, openssl, unzip, tomcat-native) to build and configure my java springboot application and it's dependencies, and the second stage is where I use a distroless base image. Now the problem is, in addition to copying the artifacts and the executable file, I also want some of the apk packages (eg. tomcat-native, openssl, curl) to be moved to this distroless image (the final stage).

Is there any way I can do this? Will I have to manually copy EACH AND EVERY file installed as part of the package installation to the next stage? If yes, how can I find those files and their locations? Or should I simply stick to a more flexible base image and not go for a distroless one in my case?

I would really appreciate some help on this. Thanks a lot!

TL;DR - Is there any way to have apk packages copied/moved to the final distroless image of a multi-stage build?

I apologize if this is not the right platform to ask this question, but I've been trying to find the answer to this for quite some time and I'm unable to find a clear answer but only mixed opinions. So here goes-

I have a multi-stage docker build where the first stage is where I install a few packages using apk (curl, openssl, unzip, tomcat-native) to build and configure my java springboot application and it's dependencies, and the second stage is where I use a distroless base image. Now the problem is, in addition to copying the artifacts and the executable file, I also want some of the apk packages (eg. tomcat-native, openssl, curl) to be moved to this distroless image (the final stage).

Is there any way I can do this? Will I have to manually copy EACH AND EVERY file installed as part of the package installation to the next stage? If yes, how can I find those files and their locations? Or should I simply stick to a more flexible base image and not go for a distroless one in my case?

I would really appreciate some help on this. Thanks a lot!

• linux
• docker
• devops
• distroless

1 Answer 1

Will I have to manually copy EACH AND EVERY file installed as part of the package installation to the next stage?

Yes.

If yes, how can I find those files and their locations?

My 3rd google hit for "how to list files in apk package" is https://dabase.com/e/17010/ , which shows it's apk info -L php-json.

Then you need to find and traverse and copy all files in all dependencies. See alpine apk: recursively list dependencies for package .

For executables, you can use ldd and copy only dependent shared libraries, and then find out file by file what else is missing, as executable might open some other files, like timezone and localtime and other files stored in /usr/share.

There is no general answer.

Or should I simply stick to a more flexible base image and not go for a distroless one in my case?

Yes.

This defeats the point of having a "distroless" image. Just use alpine, as apk is going to by itself install the packages you are going to use.