-
Notifications
You must be signed in to change notification settings - Fork 799
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Distroless base image for crd-client #3277
Changes from 2 commits
7dbece7
9b18763
6376761
c66e526
eb925f5
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -14,21 +14,18 @@ | |
|
||
# Gather dependencies and build the executable | ||
FROM golang:1.20.4 as builder | ||
WORKDIR /go/src/crd-client | ||
WORKDIR / | ||
|
||
COPY ./main.go . | ||
RUN go mod init && go mod tidy | ||
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o client . | ||
|
||
# Create the final image that will run the webhook server for FleetAutoscaler webhook policy | ||
FROM alpine:3.13.1 | ||
RUN adduser -D -u 1000 client | ||
FROM gcr.io/distroless/static-debian11:nonroot | ||
|
||
COPY --from=builder /go/src/crd-client \ | ||
/home/client | ||
COPY --from=builder /client / | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I do like just copying the binary over; that seems like an improvement from the previous commands. 👍 |
||
|
||
RUN chown -R client /home/client && \ | ||
chmod o+x /home/client/client | ||
RUN chmod o+x /client | ||
|
||
USER 1000 | ||
ENTRYPOINT /home/client/client | ||
USER nonroot:nonroot | ||
ENTRYPOINT /client |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -25,7 +25,7 @@ | |
|
||
REPOSITORY ?= us-docker.pkg.dev/agones-images/examples | ||
|
||
server_tag = $(REPOSITORY)/crd-client:0.9 | ||
server_tag = $(REPOSITORY)/crd-client:1.0 | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @markmandel - how do you feel about going from 0.9 to 1.0 vs. 0.9 to 0.10? Are we happy calling this image a 1.0 image? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. That's a good point - I figure let's go to 0.10 -- examples can always change I guess (or at least we should be consistent with our examples). There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I've changed it to 0.10 |
||
|
||
# _____ _ | ||
# |_ _|_ _ _ __ __ _ ___| |_ ___ | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm curious why you changed the paths in the build container. That shouldn't affect the location in the final container.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mark suggested moving the
WORKDIR
path to the root directory ('/').Example PR: https://github.com/googleforgames/agones/pull/3270/files
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was being consistent with everything else I've seen with distroless / done with distroless.
There's no $HOME folders in distroless, so it seems like everyone drops everything in /.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oh sorry, I should have looked at this properly - this is the build step.
🤷🏻 actually for this, I have no strong opinion.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Based on testing, the change to the root directory ('/') for WORKDIR in the build container didn't work as expected, so I've reverted it back.