You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We can add two build args POLICY_MODULE_NAME and POLICY_PACKAGE_REQUIREMENT. If they're passed at build time, we install the policy package, otherwise we don't install anything.
The main advantage of doing this: communities that only have the need to add a policy package, without customizing the images any further, wouldn't need to create custom images and could simply pass the policy package as build arg.
Downside: it might be potentially unsafe to allow dynamic installation of any package via pip; i.e. POLICY_PACKAGE_REQUIREMENT could be overridden and cause a malicious package to be installed. I think that it would be very unlikely for this to happen in a community (and even then, I don't expect that just installing a malicious Python package could cause significant damage), but it might be worth considering.
POLICY_PACKAGE_REQUIREMENTcould either point to a package name, or to a local directory - Max provided this example:
For remote installs, we could also consider passing an optional argument for pip's --index-url, so that a community could host their policy package on an index other than PyPI.
The text was updated successfully, but these errors were encountered:
Sharing this great idea by @maxnoe, already used in the Rucio containers for BDMS - their Dockerfile for reference: https://gitlab.cta-observatory.org/cta-computing/dpps/bdms/bdms-rucio-images/-/blob/main/Dockerfile?ref_type=heads
We can add two build args
POLICY_MODULE_NAME
andPOLICY_PACKAGE_REQUIREMENT
. If they're passed at build time, we install the policy package, otherwise we don't install anything.The main advantage of doing this: communities that only have the need to add a policy package, without customizing the images any further, wouldn't need to create custom images and could simply pass the policy package as build arg.
Downside: it might be potentially unsafe to allow dynamic installation of any package via pip; i.e.
POLICY_PACKAGE_REQUIREMENT
could be overridden and cause a malicious package to be installed. I think that it would be very unlikely for this to happen in a community (and even then, I don't expect that just installing a malicious Python package could cause significant damage), but it might be worth considering.POLICY_PACKAGE_REQUIREMENT
could either point to a package name, or to a local directory - Max provided this example:For remote installs, we could also consider passing an optional argument for
pip
's--index-url
, so that a community could host their policy package on an index other than PyPI.The text was updated successfully, but these errors were encountered: