Chiselled Ubuntu Containers: A Comprehensive Overview

Introduction

Canonical has officially released Chiselled Ubuntu containers, designed to be production-ready, secure, and ultra-small container images. These containers focus on efficiency and security, allowing developers to create images that include only their application and its runtime dependencies, excluding unnecessary operating system-level packages, utilities, or libraries. Canonical also provides security maintenance and support for these containers.

Key Features

1. Efficiency and Security:

   • Chiselled Ubuntu containers are optimized to be minimal, reducing bloat and resource usage.
   • They minimize dependency challenges and enhance security by reducing the number of unneeded files in the image, thereby reducing the attack surface.

2. Toolchain Integration:

   • The Chiselled Ubuntu portfolio includes images for popular toolchains such as Java, .NET, and Python.
   • For example, the Chiselled Ubuntu image for the Java Runtime Engine achieves a 51% reduction in compressed image size compared to the Eclipse Temurin Java 17 runtime image, without compromising performance.

3. Collaboration with Microsoft:

   • Microsoft has collaborated with Canonical to make Chiselled Ubuntu container images available for .NET 6, 7, and 8.
   • .NET 8 introduces security hardening options with Chiselled Ubuntu image variants, offering developers more control over container security.
   • Richard Lander, program manager for .NET at Microsoft, emphasized the benefits of these smaller and more secure container images, stating that they are the recommended base image for developers.

4. Platform Support:

   • Chiselled Ubuntu containers are available on various platforms, including AMD64, ARM-based platforms, and s390x.

Security and Maintenance

• Long-term Support: Chiselled Ubuntu containers align with Ubuntu's long-term support (LTS) guarantees, receiving 5 years of free bug fixing and security patching for containers built from the main repository.
• Library Alignment: The release cycle and library alignment with Ubuntu LTS further enhance reliability and compatibility.

Development and Deployment

• Chisel Package Manager:

  • Chiselled Ubuntu containers use an open-source package manager called Chisel, which allows developers to create ultra-small and precise file systems containing only what is necessary to run their application.
  • Chisel uses Slice Definition Files to define subsets of package contents needed at runtime, enabling fine-grained dependency management.

• Comparison to Other Solutions:

  • Chiselled Ubuntu containers solve similar needs as Google's Distroless and Chainguard's images, offering benefits such as minimizing dependency challenges, speeding up startup, and enhancing security.

Future Developments

• Work in Progress: While Chiselled Ubuntu containers offer significant advantages, Richard Lander noted in a Microsoft Devblog comment that these images will only work when all packages have slice information, which is still a work in progress.

Conclusion

Canonical's release of Chiselled Ubuntu containers provides developers with secure, efficient, and compatible containerization options. These containers are designed to reduce bloat, enhance security, and improve performance, making them a valuable tool for modern application development and deployment. More information can be found on Canonical's website.