Make our container image "distroless" #15
Conversation
boxofrad
added
the
pr/no-changelog
|
|
||
| # release-default release image | ||
| # ----------------------------------- | ||
| FROM alpine:3.16 AS release-default | ||
| FROM gcr.io/distroless/base-debian11 AS release-default |
There was a problem hiding this comment.
I tried to use the (smaller) static-debian11 image, but unfortunately, Envoy dynamically links system libraries so this is not possible.
|
Thanks we need to wait on testing with Consul K8s before merging this in, this can be done after beta. |
boxofrad
force-pushed
the
boxofrad/distroless
branch
from
c1cdbe5
to
8bda449
Compare
| // readServiceIDFromFile reads the service ID from the file specified by the | ||
| // -proxy-service-id-path flag. | ||
| // | ||
| // We do this here, rather than in the consuldp package's config handling, | ||
| // because this option only really makes sense as a CLI flag (and we handle | ||
| // all flag parsing here). | ||
| func readServiceIDFromFile() { | ||
| if serviceID == "" && serviceIDPath != "" { | ||
| id, err := os.ReadFile(serviceIDPath) | ||
| if err != nil { | ||
| log.Fatalf("failed to read given -proxy-service-id-path: %v", err) | ||
| } | ||
| serviceID = string(id) | ||
| } | ||
| } |
There was a problem hiding this comment.
Hey @ishustava @thisisnotashwin 👋🏻
Do you have an explanation of why consul-k8s needs this, rather than putting the service ID directly in the CLI flags, that I could put here?
There was a problem hiding this comment.
In K8s, we often have a different container responsible for getting the service ID to begin with. Information across containers can only be shared via files on a shared volume. It makes it significantly easier to ready what is going on if we are dealing with filepath. Putting the service ID directly to the CLI would require reading the contents of that file anyway.
| // because this option only really makes sense as a CLI flag (and we handle | ||
| // all flag parsing here). |
There was a problem hiding this comment.
I don't think it'd make sense to add this to the config file, what do you think?
boxofrad
removed
the
pr/no-changelog
|
Small suggestion, the distroless envoy container is actually |
|
Thanks, @david-yu! I think the Envoy binary itself is actually the same in the distroless and Ubuntu-based images (as it's built in a previous step). That said, we could certainly shave some time off our builds by using the distroless base 👍🏻 |
Switches our release base image to harden our security posture. See here: https://github.com/GoogleContainerTools/distroless
boxofrad
force-pushed
the
boxofrad/distroless
branch
from
691e273
to
e0b9ce7
Compare
* Make our container image "distroless" * config: make it possible to read service ID from file * docs: document how to add a shell to our container image * docker: upgrade Envoy to 1.24.0
Switches our release base image to harden our security posture.
See here: https://github.com/GoogleContainerTools/distroless