Distrolessイメージへの乗り換え #1673
Closed
Distrolessイメージへの乗り換え #1673
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
motoki317
reviewed
Feb 10, 2023
| RUN mkdir /storage | ||
|
|
||
| ARG DOCKERIZE_VERSION=v0.6.1 | ||
| RUN go install github.com/jwilder/dockerize@$DOCKERIZE_VERSION |
There was a problem hiding this comment.
この時点で CGO_ENABLED=0 無くても大丈夫なのかな
|
|
||
| FROM alpine:3.17.1 | ||
| FROM gcr.io/distroless/base:nonroot |
There was a problem hiding this comment.
userがnonrootになる(でいいのかな?)ということは、イメージを使う側でbind mountをしていたらほぼ確実に影響が出るので、リリースノートに書く & docsを変更する & 使う側で対応しないとですね
Comment on lines
+29
to
+30
| # ボリュームにマウントするディレクトリは、nonrootユーザーが所有するように | ||
| COPY --chown=nonroot:nonroot --from=build /storage/ /app/storage/ |
There was a problem hiding this comment.
/app/storage をbind mountしたときは結局ホスト側のuid/gidになっちゃいそう
motoki317
reviewed
Feb 10, 2023
Comment on lines
+35
to
+37
| COPY --from=convert /usr/lib/ /usr/lib/ | ||
| COPY --from=convert /lib/ /lib/ | ||
| COPY --from=convert /usr/bin/convert /usr/bin/ |
There was a problem hiding this comment.
結局はimagemagickのインストールが難関っぽそうですね...
こうしてdistroless側のライブラリがなにか上書きされて上手く動かなくなったりしないかとかが気になりますね
それを確かめる方法 or distroless上でどうにかしてビルドする方法ってありそうですか？
ソースからインストール、ポータブルバイナリの導入
もし覚えてたら何がだめだったのか書いてもらえると
imagemagick static compile とか調べるといろんな人が苦戦した記録が出てくるけど、様々な問題に出くわすのは確定そう
mazrean
reviewed
Feb 14, 2023
| RUN mkdir /storage | ||
|
|
||
| ARG DOCKERIZE_VERSION=v0.6.1 | ||
| RUN go install github.com/jwilder/dockerize@$DOCKERIZE_VERSION |
There was a problem hiding this comment.
go installでもbuild発生するので、ここでもmount=type=cacheしても良さそう
|
imagemagicを綺麗に入れられる可能性がだいぶ薄いので、traQでは諦めようと思います |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
alpineで出てくるvulnerabilityに辟易することがあるので、よりvulnerabilityを孕む可能性の低いdistrolessに乗り換えようと決意した