TOP-5 Lightweight Linux Distributions for Containers

Transcript:

Let's look at the top five Linux distributions for container images. There is going to be no ranking of which one is best or worst, only facts so that you can make an informed decision about the base image for your application.

Alpine Linux is the first distro that comes to mind when someone says a lightweight base for containers. It is minimalistic, clean, simple, and very common in Dockerfiles. It does not include any unnecessary packages and uses musl libc instead of glibc, BusyBox, the OpenRC init system instead of systemd, and Alpine Package Keeper, or APK, as the package manager. All these tools are associated with less bloat and smaller overhead. As a result, the compressed image size of Alpine on Docker Hub is less than 4 MB. But if you need extra packages, you can easily pull them from the repository.

Alpine is 100% free and open source. As for releases, it has a predictable rhythm. Stable branches are released twice a year, typically in May and November. The main repository is generally supported for two years. Ironically, its drawbacks come from its strong sides. There is no LTS program in the enterprise sense, and there is no commercial support from the Alpine team. Also, the musl library may have inferior performance compared to glibc for some workloads, especially Java-based ones.

Alpaquita Linux is developed and supported by BellSoft. Like Alpine, it was designed to be minimalistic, efficient, and secure. It also uses BusyBox, OpenRC, and APK. But as for the libc variant, it offers two flavors: the glibc one and musl perf. Musl perf has performance equal to or even superior to glibc. So, the Alpaquita musl image on Docker Hub is less than 4 MB, and the glibc image is about 9 MB.

One of the strong sides of Alpaquita is that it integrates seamlessly with other BellSoft products for Java development, such as Liberica JDK and Liberica Native Image Kit. That might be a very good option for Java teams. Also, there is a set of hardened images with a minimized attack surface, provenance data, and SLA for patches both for the OS and the runtime from the BellSoft team.

From a maintenance perspective, Alpaquita comes in Stream, which is a rolling continuously updated release, and LTS versions, which are supported for four years. Like Alpine, Alpaquita is open source and free to use in production, but it is covered by an EULA, and commercial support is available from the BellSoft team. The drawback might be the limited choice of packages in the repository.

Chiseled Ubuntu is Canonical's way to take the best of two worlds. On the one hand, almost a distroless image. On the other hand, a well-known and widely used Ubuntu. With the tool called Chisel, you cut out a custom OS for your application. As a result, you get Ubuntu's ecosystem and LTS releases, but the container image is stripped down to the essentials.

Chiseled Ubuntu images often include no shell and no package manager in the final image, which is good for minimizing the attack surface. Chiseled Ubuntu uses glibc and benefits from Ubuntu's broad compatibility. It is open source, but commercial support is also available from Canonical. Size-wise, Chiseled Ubuntu images can be around 5 or 6 MB, but that depends on the runtime and your specific workload.

The drawback again comes from the strong side. You have to cut out the custom OS yourself manually. There are no ready-to-use images. And if your application changes, you have to repeat the process.

Red Hat UBI Micro is Red Hat's base image with a compressed size of about 10 MB. The image is part of the Red Hat UBI family. So, this is Red Hat as you know it, glibc-based and seamlessly compatible with Red Hat infrastructure. But like Chiseled Ubuntu, these images are stripped down to the essentials. The images are updated regularly, and LTS releases are based on the Red Hat lifecycle model.

Licensing is an important nuance here. UBI images are described as freely redistributable, but under the Red Hat EULA, and support is part of a Red Hat subscription program. In practice, teams may want to pick UBI Micro when they want Red Hat infrastructure and Red Hat compatibility. So, if your infrastructure is already based on Red Hat solutions, choosing UBI Micro is a logical way to go.

Wolfi is maintained by Chainguard. It is a container-first Linux undistro, as the vendor calls it, which was designed around modern supply chain security standards. It uses APK like Alpine, but unlike Alpine, it uses glibc. The images are minimalistic and come with a software bill of materials.

Wolfi is used as the base for Chainguard OS, which in turn is used as a base for Chainguard containers. Chainguard containers, in turn, are distroless images that are rebuilt daily and come with provenance data. So, Wolfi, Chainguard OS, and Chainguard containers all form part of the same ecosystem.

Wolfi is open source and freely available under the Apache License 2.0. There is no commercial support for Wolfi itself, but commercially, Chainguard has a paid offering around the hardened Chainguard containers. For Chainguard containers, there are support commitments and patch SLAs.

Wolfi's release model is explicitly rolling. The focus is on fast package updates. There is no LTS concept for Wolfi like there is for Ubuntu or other vendor-backed distributions. So, it might be unsuitable for cases requiring LTS support or very stable long-term deployments.

And that was the list of the top five Linux distributions for container images. I have prepared a convenient PDF comparison table that you can download by following the link in the description. If you liked this video, don't forget to give it a little love, subscribe to our channel, and until next time.