Suggest using Chainguard images #400
Conversation
|
For some reason building the Docker image locally worked for me. Investigating to see why the permission error comes up here via the GitHub Actions |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
stale
bot
added
the
issue/stale
|
Chainguard have made some changes to their images which configures a nonroot user within their image. This causes a slight issue when wanting to configure a user. Still want to make a note and state that I am still researching this. |
stale
bot
removed
the
issue/stale
|
bump |
There was a problem hiding this comment.
Hi, @acald-creator thanks for your contribution. I believe we use the official Dockerfile for building the binary is ok. There is no reason to replace it with others because there is no need for any further configuration.
| # Refer to https://github.com/GoogleContainerTools/distroless for more details | ||
| FROM gcr.io/distroless/static:nonroot | ||
| # Instead of using distroless, use Chainguard images | ||
| FROM cgr.dev/chainguard/static:latest |
There was a problem hiding this comment.
Is there any issue with the permission of execution so we need to replace this image?
There was a problem hiding this comment.
@Aisuko hey thanks for reaching out.
I've been following Chainguard pretty closely, and I'm been working in my spare time learning about SBOM and lower potential vulnerabilities in Docker images.
Chainguard advocates software supply chain security in this, so I'm also thinking we can at least follow what they're doing.
At the time I did this PR, Chainguard static image was not allowing other users to be used in the image.
Since then, I did find out that they have updated this to allow a certain limited range of users.
I'm still researching this, and we may or may not go this route immediately, but in the future, I would like to be able to use their images or at least a custom docker image.
Also, there is a slight discrepancies in some of the ditroless images across all meshery adapters, but it's not important now.
I still want to keep working on this.
There was a problem hiding this comment.
Thank you @acald-creator. I see. As you said their base image is professional in security. Is there any limit(e.g, open-source License)? I saw they are a company who are in the container security industry.
There was a problem hiding this comment.
Welcome to continue work on this.
There was a problem hiding this comment.
@Aisuko Sorry for the delay in the response, but here is the link to Chainguard images at Apache 2.0 license.
https://github.com/chainguard-images/images/blob/main/LICENSE
I'm not aware of what Layer5 may have on what licenses to accept or not when using others' tools.
There was a problem hiding this comment.
At the time of opening this PR, Chainguard was building their images using apko and melange, and their base image which is now wolfi was not available at the time.
There were permissions issues because they changed the permissions for nonroot user in the static image, which could conflict with meshery-operator permissions.
I will have to revisit this to see if the Dockerfile builds as expected and works properly.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
There was a problem hiding this comment.
@Azanul it was mentioned in this conversation block, changing from FROM gcr.io/distroless/static:nonroot to FROM cgr.dev/chainguard/static:latest.
After I tracked the issue at Chainguard, they were working on updating the permissions for the static image, which has been updated since, but I have not tested this Dockerfile.
There was a problem hiding this comment.
We are ✅ with respect to licensing concerns.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
Apache v2 is acceptable. |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
stale
bot
added
the
issue/stale
acald-creator
added
issue/willfix
acald-creator
added
issue/blocked
|
Checking in... it has been awhile since we've heard from you on this issue. Are you still working on it? Please let us know and please don't hesitate to contact a MeshMate or any other community member for assistance.
|
Signed-off-by: Antonette Caldwell <[email protected]>
acald-creator
force-pushed
the
acald.dockerfile
branch
from
775b8ac
to
2be2238
Compare
Codecov ReportPatch and project coverage have no change.
Additional details and impacted files@@ Coverage Diff @@
## master #400 +/- ##
=======================================
Coverage 45.35% 45.35%
=======================================
Files 3 3
Lines 183 183
=======================================
Hits 83 83
Misses 95 95
Partials 5 5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Signed-off-by: Antonette Caldwell [email protected]
Description
This PR fixes #
Notes for Reviewers
Signed commits