Images to make use of statically linked binaries to remove need for libc6-compat

[chadlwilson]

Please excuse my ignorance here if this is the wrong place to raise this, but thought it might be useful to have a placeholder folks could follow. Not sure if something can be done in this repo right now, or we would still be waiting on another part of the docker ecosystem.

Background

• Last year in add workaround for non-static ctr binary in docker 20.10.8 #323 libc6-compat was added into the Alpine images to address an issue with ctr not being fully statically linked as noted in Statically compiling ctr fails on Go 1.15 and up (segfault or not statically linked) containerd/containerd#5824
• Since then this addition of libc6-compat has migrated a few places: https://github.com/docker-library/docker/search?q=libc6-compat e.g
  

  docker/Dockerfile-cli.template

  Lines 4 to 7 in 04ae082

  	RUN apk add --no-cache \
  	ca-certificates \
  	# Workaround for golang not producing a static ctr binary on Go 1.15 and up https://github.com/containerd/containerd/issues/5824
  	libc6-compat \

• since the libc6-compat library can conflict with alternatives folks might want to use (e.g gcompat or... gasp.... alpine glibc 🙈) it can cause child images to have to apk del --purge libc6-compat so seems would be better without it if it can be avoided

Current State (Sep 2022)

• In containerd 1.6.7 a fix was backported to allow building static binaries simpler via
  • Make building static binaries simpler containerd/containerd#7022
  • [release/1.6] Make building static binaries simpler containerd/containerd#7045
• Docker 20.10.18 includes containerd 1.6.8 but not sure if the Alpine builds are all fully static just yet
• docker-proxy fixed to be static in fix docker-proxy not statically linked moby/moby#43621
• A mega pull was at fix docker-proxy and ctr not statically linked moby/moby#43492 but the ctr bits had problems so look like not merged.
• Fixing static build of ctr may be waiting on Enhanced Dockerfile for cross compilation moby/moby#43529 or similar.

[tianon]

Agreed, it would be great to remove this dependency -- at the very least, we could move it to the dind images now that the CLI and Docker-in-Docker are separated (#369).

I just did some testing on the ctr builds we currently consume both in 20.10 and 22.06-rc and they do still exhibit the issue, so short of building ctr from source ourselves in the image (which I don't plan to do at this layer), we are a bit at the mercy of the upstream builds. 😞

[tianon]

at the very least, we could move it to the dind images now that the CLI and Docker-in-Docker are separated (#369)

Hmm, although there's a decent argument to be made for ctr existing in the CLI images, especially with https://github.com/moby/moby/labels/containerd-integration well-underway. 🤔

[chadlwilson]

Thanks for replying and giving it a test - tried to do this myself in this repo, but got lost in the scripting here :-) Let's see how things go upstream; hopefully we have the right issues opened/pull requests underway to make this happen at some point.

[chadlwilson]

Am I right in thinking after moby/moby#44659 that ctr should be static in 23.x?

[tianon]

Yeah! Just tested and 20.10 is still affected, but 23.0 looks fine! Will be sending a PR shortly. 💪

[chadlwilson]

Thanks, very nice! 🥳

Happy to close this unless we think there's a realistic chance of the underlying improvements getting back-ported to 20.10?

[tianon]

Yeah, I guess that's a fair point; the chances of backporting the fixes are indeed low. 👍