impact for KIP-975: official docker image for Apache Kafka

[showuon]

Hi all,
I'd like to let you know that there's a KIP-975 proposed to build an official Docker Image for Apache Kafka. There's no much detail in the KIP, and still under discussion. The only thing we know is:

    Java version: 17
    Base Image: ubi-minimal

They align with the current image setting in strimzi.

I'm starting this discussion to see if strimzi wants to adopt the official docker image, or we still want to build our own image? And why? Also, since there are not much detail in the KIP right now, it'd better we provide suggestions in the KIP discussion using our experience, like any must-have utils needed to be installed? Or any issues we have while maintaining the images?

Thanks.

[scholzj]

I think it would depend on a lot of details. But overall, I'm not sure it would give us many advantages.

• We would still need to build our own images:
  • We add a lot of our own stuff scripts, libraries, tools, etc.
  • We need to have control over CVE fixes on the OS level of the container
  • We need to do container signing etc.

So we would essentially just change one base image for another base image. The layering of the new resulting base image might (not sure it would cause any practical issues, it might, it might not) be more complicated due to how we add our own libraries etc. to the image. We would also need Kafka to support all hardware platforms we might want to support (currently amd64, arm64, s390x and ppc64le -> but others might be added in the future such as demand shows up, e.g. risc-v etc.). There are also many aspects that people don't agree on that might cause issues here. Such as should the image have Java JRE (smaller, more secure) or JDK (bigger, less secure, but has tools that help with debugging). It resulting container image would be a mess if you have to uninstall the JDK from Kafka image and install JRE on our level etc.

So I'm not sure it adds any value and instead, it just takes away our control over the things such as the Java version etc.

I think having an official Kafka container image would be useful in many situations. But in general, I would expect projects like Strimzi to use their own because they will need some non-trivial customizations.