Skip to content

Commit

Permalink
Merge pull request #10 from gardenlinux/feat/doc_container_usage
Browse files Browse the repository at this point in the history
doc: direct container image usage
  • Loading branch information
nkraetzschmar authored Dec 2, 2024
2 parents 50a92af + bbb0d1c commit 415a029
Showing 1 changed file with 27 additions and 2 deletions.
29 changes: 27 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

The **unbase OCI tool** is designed to streamline container images by eliminating unnecessary components inherited from the base container, thereby reducing bloat and enhancing security.
It produces [bare container images](https://github.com/gardenlinux/gardenlinux/blob/main/docs/01_developers/bare_container.md).
Operating on OCI archives, the tool performs a thorough comparison between a base image and a target image.
Operating on OCI archives or container images, the tool performs a thorough comparison between a base image and a target image.
It identifies additions made to the target image in relation to the base image, as well as the dependencies of these additions.
The tool then strips away extraneous elements, resulting in a minimized target image.

Expand All @@ -29,6 +29,19 @@ chmod +x unbase_oci
```
./unbase_oci [options] base_image target_image output_image
base_image, target_image, and output_image can either be OCI-archive file names
or container images of the form "${container_engine}:${image}" where ${container_engine}
is `podman`.
For this the images must already be pulled in the local image storage of ${container_engine}.
See the usage example below.
For all but base_image you can use the ":${tag}" shorthand to indicate that the same container engine
and image name as the previous arg should be used, but with a different tag.
If target_image is not using the shorthand notation, then base_image can be set to "auto".
This will automatically resolve the base_image based on meta-data in the target_image.
Note: this only works for images locally build via a Containerfile/Dockerfile.
Options:
-i, --include INCLUDE_FILE Specify regex patterns to selectively include files.
Patterns are in grep extended regex format (one per line).
Expand Down Expand Up @@ -57,7 +70,19 @@ Options:

## Example Usage

For instance, consider building a container on top of a Debian base. Let's assume `debian.oci` represents an exported OCI archive of the Debian base image, while `container.oci` is an exported OCI archive of the target image. To create a *bare* variant of the target container, containing only the dependencies of explicitly installed components on top of Debian (e.g.: libc), execute:
For instance, consider building a container on top of a Debian base.
Let's assume you build your container with a `Containerfile` based on the `debian` image.
To create a *bare* variant of the target container, containing only the dependencies of explicitly installed components on top of Debian (e.g.: libc), execute:

```shell
podman pull debian
podman build -t container .
./unbase_oci --ldd-dependencies podman:debian podman:container:latest podman:container:bare
```

After running this command, the image `container:bare` is available in your local podman instance.

If you work with exported oci archives, the equivalent command is:

```shell
./unbase_oci --ldd-dependencies debian.oci container.oci container_bare.oci
Expand Down

0 comments on commit 415a029

Please sign in to comment.