Thoughts around a dedicated image for Kafka Connect?

[andrijadukic]

Hi! What are your thoughts around using a different base image for Kafka Connect - one that only has the resources needed for Kafka Connect, as opposed to everything that is needed to run Kafka?
I can't think of a significant drawback to having a dedicated base image, and see these two quite important benefits:

• Smaller Kafka Connect worker image size
• Less security vulnerabilities that will get picked up by image scanning tools (this one is especially important in enterprise environments)

Curious to hear your thoughts

[scholzj]

Strimzi uses the binaries as produced by Apache Kafka and relies on the release and testing process done by Apache Kafka. There is no Connect-only binary provided by the Apache Kafka project and we certainly have no intention of creating our own Kafka binaries. There is also a lot of overhead connected to yet another container image to maintain, test, and release -> both in terms of the human effort as well as the requirements for the CI resources, the length of the CI runs etc. So I do not think there is any plan to do anything like that.

[andrijadukic]

Thanks @scholzj ! Sorry for not clarifying, I wasn't referring to the Kafka binaries themselves, but rather the stuff added on top which is needed for the Kafka CRDs, but not Kafka Connect: Cruise Control, Kafka Exporter, etc. since those take up some space and could potentially flag the image as having some vulnerability that wouldn't otherwise be present. A good example would be CVE-2024-45337 in the Kafka Exporter (which is fixed in 1.9.0).
Obviously vulnerabilities are bound to show up on occasion, but this would decrease the likelihood simply by having fewer things to cause them.

[scholzj]

That is a fair point. We used to have separate container images for each of these. But as I said, the overhead for that was too big so we moved away from that.

I guess if needed, you can easily remove the parts of the image you don't use through a custom Dockerfile.

[andrijadukic]

Yeah I was thinking of pruning some of the things that aren't needed in Connect by extending the image, just wanted to check first if there are plans already for this, but I understand the complexity in maintaining another image.
Thanks!

[scholzj]

I hope that one day the OCI image volumes might make it easier to compose applications like this. But they are still behind a feature gate in Kubernetes. So it will take some time for it to reach the maturity where we can start using them for things like that.

[ppatierno]

We just use binaries coming from Apache Kafka upstream which includes everything (brokers, connect and so on).
Adding a new image would mean more burden for maintaining, testing and releasing.
Tbh my opinion is about sticking with the current status.

[andrijadukic]

Hi @ppatierno , replied in the other thread, thanks!

[ppatierno]

Yeah thanks I saw it. I can just reinforce what Jakub said.