Dockerfile multistage with bci-micro #166
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Use bci-minal as final image Buil/Copy binaries from builder to final
…uired packages with zypper 2. Use micro image as final image
Resolves the following error in run_sonobuoy_plugin.sh + tar -czf kb.tar.gz controlplane.json error.log etcd.json master.json node.json policies.json /bin/sh: gzip: command not found
pjbgf
previously approved these changes
Sep 29, 2023
|
Diving in We could potentially go to |
macedogm
requested changes
Oct 2, 2023
pjbgf
previously approved these changes
Oct 2, 2023
macedogm
previously approved these changes
Oct 2, 2023
|
@andypitcher Could you please resolve the conflicts? |
Done. also replaced kubectl download URL from storage.googleapis.com to dl.k8s.io as per kubernetes/k8s.io#2396 |
macedogm
previously approved these changes
Nov 23, 2023
pjbgf
reviewed
Nov 24, 2023
| zypper --installroot /chroot clean -a && \ | ||
| rm -rf /chroot/var/cache/zypp/* /chroot/var/log/zypp/* | ||
|
|
||
| # Main stage using bco-mirco as the base image |
There was a problem hiding this comment.
nit:
Suggested change
| # Main stage using bco-mirco as the base image | |
| # Main stage using bco-micro as the base image |
pjbgf
previously approved these changes
Nov 24, 2023
pjbgf
approved these changes
Dec 7, 2023
|
Infracloud is testing this. |
|
@MKlimuszka it may be worth testing this together with rancher/cis-operator#232. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Parent issue: https://github.com/rancher/security-team/issues/387
This PR covers the following:
Tested with RKE2, the scan is working and delivers the same results:
Note: The final image size can't be smaller than ~280MB even if we're using bci-micro here. Indeed, the number of binaries and their dependencies increases it. This said here are some advantages using micro here:
zypperis here by default. This might help an attacker to install other artifacts onto the container.403when usingbci-baseand354when usingbci-micro.