Even though using Alpine as the base image for a container is a lot beter&#x2F;cleaner than other base image imho we shouldn&#x27;t rely on distro package management inside containers.<p>Not only does running a package manager inside the container mean you&#x27;ll need to satisfy its dependencies in your image you also increase the image&#x27;s attack surface compared to an image without a package manager.<p>Ideally we&#x27;d have a simple way of installing stuff into images from the outside so you can always start `FROM scratch` and add the minimum deps you need to run your app.
Adding stuff could be as simple as extracting tars with the tar&#x27;s contents following the Filesystem Hierarchy Standard. Each tar could be a layer so it matches well with how Docker images work as well.<p>Since it isn&#x27;t possible to extend the Dockerfile syntax I started prototyping a static binary written in Go to add to `scratch` to do this. It worked better than I expected :)
Only thing I couldn&#x27;t find was a distro that packaged it&#x27;s packages this way and it would obviously suck to create another packaging standard.