Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Suggest using Chainguard images #400

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

acald-creator
Copy link
Contributor

Signed-off-by: Antonette Caldwell [email protected]

Description

This PR fixes #

Notes for Reviewers

Signed commits

  • Yes, I signed my commits.

@acald-creator
Copy link
Contributor Author

For some reason building the Docker image locally worked for me. Investigating to see why the permission error comes up here via the GitHub Actions

@stale
Copy link

stale bot commented Dec 31, 2022

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the issue/stale Issue has not had any activity for an extended period of time label Dec 31, 2022
@acald-creator
Copy link
Contributor Author

Chainguard have made some changes to their images which configures a nonroot user within their image. This causes a slight issue when wanting to configure a user.

Still want to make a note and state that I am still researching this.

@stale stale bot removed the issue/stale Issue has not had any activity for an extended period of time label Jan 4, 2023
@acald-creator
Copy link
Contributor Author

bump

@leecalcote leecalcote self-requested a review January 17, 2023 03:36
Copy link
Member

@Aisuko Aisuko left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi, @acald-creator thanks for your contribution. I believe we use the official Dockerfile for building the binary is ok. There is no reason to replace it with others because there is no need for any further configuration.

# Refer to https://github.com/GoogleContainerTools/distroless for more details
FROM gcr.io/distroless/static:nonroot
# Instead of using distroless, use Chainguard images
FROM cgr.dev/chainguard/static:latest
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any issue with the permission of execution so we need to replace this image?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Aisuko hey thanks for reaching out.

I've been following Chainguard pretty closely, and I'm been working in my spare time learning about SBOM and lower potential vulnerabilities in Docker images.

Chainguard advocates software supply chain security in this, so I'm also thinking we can at least follow what they're doing.

At the time I did this PR, Chainguard static image was not allowing other users to be used in the image.

Since then, I did find out that they have updated this to allow a certain limited range of users.

I'm still researching this, and we may or may not go this route immediately, but in the future, I would like to be able to use their images or at least a custom docker image.

Also, there is a slight discrepancies in some of the ditroless images across all meshery adapters, but it's not important now.

I still want to keep working on this.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @acald-creator. I see. As you said their base image is professional in security. Is there any limit(e.g, open-source License)? I saw they are a company who are in the container security industry.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Welcome to continue work on this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Aisuko Sorry for the delay in the response, but here is the link to Chainguard images at Apache 2.0 license.

https://github.com/chainguard-images/images/blob/main/LICENSE

I'm not aware of what Layer5 may have on what licenses to accept or not when using others' tools.

Copy link
Contributor Author

@acald-creator acald-creator May 6, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Azanul

At the time of opening this PR, Chainguard was building their images using apko and melange, and their base image which is now wolfi was not available at the time.

There were permissions issues because they changed the permissions for nonroot user in the static image, which could conflict with meshery-operator permissions.

I will have to revisit this to see if the Dockerfile builds as expected and works properly.

This comment was marked as outdated.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Azanul it was mentioned in this conversation block, changing from FROM gcr.io/distroless/static:nonroot to FROM cgr.dev/chainguard/static:latest.

After I tracked the issue at Chainguard, they were working on updating the permissions for the static image, which has been updated since, but I have not tested this Dockerfile.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are ✅ with respect to licensing concerns.

This comment was marked as outdated.

@acald-creator acald-creator self-assigned this Feb 2, 2023
Copy link
Member

Apache v2 is acceptable.

@stale
Copy link

stale bot commented Mar 19, 2023

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the issue/stale Issue has not had any activity for an extended period of time label Mar 19, 2023
@acald-creator acald-creator added issue/willfix This issue will be worked on and removed issue/stale Issue has not had any activity for an extended period of time labels Mar 19, 2023
@acald-creator acald-creator added issue/blocked Issue is blocked issue/remind Issue progress check labels Apr 29, 2023
@github-actions
Copy link

Checking in... it has been awhile since we've heard from you on this issue. Are you still working on it? Please let us know and please don't hesitate to contact a MeshMate or any other community member for assistance.


        Be sure to join the community, if you haven't yet and please leave a ⭐ star on the project 😄

Signed-off-by: Antonette Caldwell <[email protected]>
@codecov
Copy link

codecov bot commented May 13, 2023

Codecov Report

Patch and project coverage have no change.

Comparison is base (27cfe5f) 45.35% compared to head (2be2238) 45.35%.

Additional details and impacted files
@@           Coverage Diff           @@
##           master     #400   +/-   ##
=======================================
  Coverage   45.35%   45.35%           
=======================================
  Files           3        3           
  Lines         183      183           
=======================================
  Hits           83       83           
  Misses         95       95           
  Partials        5        5           
Flag Coverage Δ
unittests 45.35% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
issue/blocked Issue is blocked issue/remind Issue progress check issue/willfix This issue will be worked on
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants