Recommendations for chainguard image including Java and Python

[mwager]

Hello,

I am consulting in a product security team and we are recommending chainguard images. Currently we have an application which needs Java and Python runtimes. I tried using the chainguard java image and using apk to install python, pip and other things needed.

Is there any recommendation, blogpost or smt which shows if I am on the right track?

Appreciate any anyswers!

Btw, I wrote my master thesis on the subject, which eveluates different "distroless" methods. Chainguard stands out! :)

https://mwager.de/assets/component_reduction_paper.pdf

KR
Michael

Dockerfile:

FROM cgr.dev/chainguard/jre:latest-dev

# switch to root in order to install packages
USER root
RUN apk update
RUN apk update && apk add python-3.12 py3-pip
RUN pip install poetry
RUN poetry install --only main
...
USER java
EXPOSE 4500
ENTRYPOINT ["/usr/bin/poetry run start"]

[amouat]

That thesis looks great! Thanks for the link.

Your Dockerfile looks fine to me. You could also consider starting from cgr.dev/chainguard/wolfi-base and installing both the JRE and python from apk.

[mwager]

Thanks for the answer!