Use distroless image for operator image #533
Conversation
AKamyshnikova
force-pushed
the
distroless
branch
2 times, most recently
from
7922a54 to
a25aef4
Compare
Codecov ReportPatch and project coverage have no change.
Additional details and impacted files@@ Coverage Diff @@
## master #533 +/- ##
=======================================
Coverage 85.12% 85.12%
=======================================
Files 12 12
Lines 1613 1613
=======================================
Hits 1373 1373
Misses 155 155
Partials 85 85 Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. ☔ View full report in Codecov by Sentry. |
To avoid security issues switch to usage of distroless image. Also bumped go version to 1.19 Fixes: pravega#508 Signed-off-by: Ann Taraday <[email protected]>
AKamyshnikova
force-pushed
the
distroless
branch
from
a25aef4 to
9706b5f
Compare
|
|
||
| ARG PROJECT_NAME=zookeeper-operator | ||
|
|
||
| COPY --from=go-builder /src/${PROJECT_NAME} /usr/local/bin/${PROJECT_NAME} | ||
|
|
||
| RUN adduser -D ${PROJECT_NAME} |
There was a problem hiding this comment.
@AKamyshnikova why are we removing the user
There was a problem hiding this comment.
@anishakj For distrolless image we cannot run adduser command. I will add update this.
There was a problem hiding this comment.
@anishakj Seems this setting is no longer required.
Signed-off-by: Ann Taraday <[email protected]>
AKamyshnikova
force-pushed
the
distroless
branch
from
93ffa69 to
cabf888
Compare
Signed-off-by: Ann Taraday <[email protected]>
Dockerfile
Outdated
| @@ -28,14 +28,10 @@ COPY controllers/ controllers/ | |||
| RUN GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o /src/${PROJECT_NAME} \ | |||
| -ldflags "-X ${REPO_PATH}/pkg/version.Version=${VERSION} -X ${REPO_PATH}/pkg/version.GitSHA=${GIT_SHA}" main.go | |||
|
|
|||
| FROM ${DOCKER_REGISTRY:+$DOCKER_REGISTRY/}alpine:${ALPINE_VERSION} AS final | |||
|
|
|||
| FROM gcr.io/distroless/static:nonroot AS final | |||
There was a problem hiding this comment.
Currently available images are: https://github.com/GoogleContainerTools/distroless#what-images-are-available
That is, maybe we should use gcr.io/distroless/static-debian11 directly instead of gcr.io/distroless/static. I think static is a link to the latest build static-debian11, but we should use the latest build explicitly, so that we have a reproducible build and so we don't auto-upgrade images when the static link changes.
Signed-off-by: Ann Taraday <[email protected]>
Dockerfile
Outdated
| @@ -28,14 +28,10 @@ COPY controllers/ controllers/ | |||
| RUN GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o /src/${PROJECT_NAME} \ | |||
| -ldflags "-X ${REPO_PATH}/pkg/version.Version=${VERSION} -X ${REPO_PATH}/pkg/version.GitSHA=${GIT_SHA}" main.go | |||
|
|
|||
| FROM ${DOCKER_REGISTRY:+$DOCKER_REGISTRY/}alpine:${ALPINE_VERSION} AS final | |||
|
|
|||
| FROM gcr.io/distroless/static-debian11:nonroot AS final | |||
There was a problem hiding this comment.
Please keep the option to use DOCKER_REGISTRY arg
There was a problem hiding this comment.
DOCKER_REGISTRY is different for golang build image and distroless final. I will introduce DISTROLESS_DOCKER_REGISTRY.
AKamyshnikova
force-pushed
the
distroless
branch
from
32fb1c5 to
71008a5
Compare
Signed-off-by: Ann Taraday <[email protected]>
AKamyshnikova
force-pushed
the
distroless
branch
from
71008a5 to
864ecb9
Compare
Makefile
Outdated
| @@ -23,6 +23,7 @@ GIT_SHA=$(shell git rev-parse --short HEAD) | |||
| TEST_IMAGE=$(TEST_REPO)-testimages:$(VERSION) | |||
| DOCKER_TEST_PASS=testzkop@123 | |||
| DOCKER_TEST_USER=testzkop | |||
| DISTROLESS_DOCKER_REGISTRY=gcr.io | |||
There was a problem hiding this comment.
@AKamyshnikova is this line needed, if we not mentioned this registry it will take gcr.io as default rt
There was a problem hiding this comment.
Yes, it can be dropped - I forgot to drop after I add default in Dockerfile
Signed-off-by: Ann Taraday <[email protected]>
To avoid security issues switch to usage of distroless image.
Also bumped go version to 1.19
Fixes: #508