build: Install wget in development docker image #33288
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
It's needed by `make common_constraints.txt`. We're starting to see failures running this command in lms-shell in devstack. This has probably been going on the entire time, but the error suppression was only removed recently in <#33271>. The new RUN instruction for installing wget is added to the development layer only, partly to limit image sizes and partly to make life harder for any attacker who manages to gain code execution in production. I've moved `USER app` from the end of the `base` layer to the start of the `production` layer, since the only other layer (in this file) that builds on `base` is `development`, which more or less immediately switches back to root. (The intervening COPY instruction is not affected by the current user.) Ticket: #33287
|
I've tested that |
johnnagro
approved these changes
Sep 19, 2023
|
2U Release Notice: This PR has been deployed to the edX staging environment in preparation for a release to production. |
|
2U Release Notice: This PR has been deployed to the edX production environment. |
|
2U Release Notice: This PR has been deployed to the edX staging environment in preparation for a release to production. |
|
2U Release Notice: This PR has been deployed to the edX production environment. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It's needed by
make common_constraints.txt. We're starting to seefailures running this command in lms-shell in devstack. This has probably
been going on the entire time, but the error suppression was only removed
recently in #33271.
The new RUN instruction for installing wget is added to the development
layer only, partly to limit image sizes and partly to make life harder for
any attacker who manages to gain code execution in production.
I've moved
USER appfrom the end of thebaselayer to the start of theproductionlayer, since the only other layer (in this file) that buildson
baseisdevelopment, which more or less immediately switches backto root. (The intervening COPY instruction is not affected by the current
user.)
Ticket: #33287