-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Switch to ghcr.io/distroless/busybox
for shell-image
#4762
Conversation
d3b4487
to
315ef44
Compare
315ef44
to
2752c85
Compare
This is very similar to tektoncd#4758 and tektoncd#4717 but for `shell-image`. This switches the default user of the `shell-image` to `nonroot`, which forces Tekton to be explicit about all of the places it needs a shell as `root` using `runAsUser: 0`. This also switches things over to a much leaner `busybox` image (no `glibc`), which is the main thing we use `base:debug` for with the OG distroless images. Fixes: tektoncd#4761 Related: tektoncd#4752
2752c85
to
90e86cf
Compare
ghcr.io/distroless/busybox
for shell-image
ghcr.io/distroless/busybox
for shell-image
/hold I am optimistic this will now pass e2e testing, so removing the |
/lgtm Thanks! |
/test pull-tekton-pipeline-alpha-integration-tests Sidecar test flake 😞 |
isolated-workspaces 🙄 /test pull-tekton-pipeline-alpha-integration-tests |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: vdemeester The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/test pull-tekton-pipeline-integration-tests Going to run e2e once more with the nightly images |
Let's get it baking /hold cancel |
This is very similar to #4758 and #4717 but for
shell-image
. This switches the default user of theshell-image
tononroot
, which forces Tekton to be explicit about all of the places it needs a shell asroot
usingrunAsUser: 0
.This also switches things over to a much leaner
busybox
image (noglibc
), which is the main thing we usebase:debug
for with the OG distroless images.Fixes: #4761
Related: #4752
/kind cleanup
Submitter Checklist
As the author of this PR, please check off the items in this checklist:
functionality, content, code)
(if there are no user facing changes, use release note "NONE")
Release Notes