Use multistage build for gateway #1506
Conversation
Signed-off-by: Paul S. Schweigert <paul@paulschweigert.com>
There was a problem hiding this comment.
@akihikokuroda could you take a look to this PR? I would like a double check apart from my side around this change 🙏
Regardless of my only comment I see everything fine but I would like another review from Aki if it's possible.
|
|
||
| # APP image from `scratch` which will be the final image | ||
| # and remaining application requirements will be installed | ||
| FROM scratch AS APP |
There was a problem hiding this comment.
I wonder why this APP image is necessary. What is the difference between copying back the ${MICRO_IMAGE_DIR}/ into the BASE image and the APP image?
There was a problem hiding this comment.
The BASE image still has things like a package manager and a shell that the gateway really doesn't need, whereas scratch / APP is empty except for what we explicitly add to it. So that does two things: (a) it reduces the number of components that we have to manage for CVEs, and (b) it reduces the threat vectors for that particular container.
There was a problem hiding this comment.
I may be wrong but I read
COPY --from=BASE / ${MICRO_IMAGE_DIR}
copies everything in the BASE to ${MICRO_IMAGE_DIR} directory and
COPY --from=BUILD ${MICRO_IMAGE_DIR}/ .
copies everything in the BASE + additional pieces to the APP
So everything in the BASE is copied to APP. Where am I misunderstanding?
There was a problem hiding this comment.
You could be right... I'm just copying from what another team already did and didn't look too closely at what they were doing, I just assumed it worked since it had already gone through review.
|
|
||
| # hadolint ignore=DL3013 | ||
| RUN pip install --upgrade --no-cache-dir pip>=24.2 &&\ | ||
| pip install --upgrade --no-cache-dir setuptools>=72.1.0 |
There was a problem hiding this comment.
Is the setuptools unnecessary after all or is the right version in ubi9-micro:9.4-15?
There was a problem hiding this comment.
I was assuming that the scratch image doesn't have setuptools so it shouldn't need to be updated. but maybe it will be?
There was a problem hiding this comment.
I'm not sure. Scan will tell us :-)
There was a problem hiding this comment.
all hail general scan 😆
No description provided.