Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Suggest using Chainguard images #400

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Suggest using Chainguard images #400

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Build the manager binary
FROM golang:1.19 as builder
FROM cgr.dev/chainguard/go:latest as builder

WORKDIR /workspace
# Copy the Go Modules manifests
Expand All @@ -18,9 +18,8 @@ COPY pkg/ pkg/
# Build
RUN CGO_ENABLED=0 GO111MODULE=on go build -a -o manager main.go

# Use distroless as minimal base image to package the manager binary
# Refer to https://github.com/GoogleContainerTools/distroless for more details
FROM gcr.io/distroless/static:nonroot
# Instead of using distroless, use Chainguard images
FROM cgr.dev/chainguard/static:latest
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any issue with the permission of execution so we need to replace this image?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Aisuko hey thanks for reaching out.

I've been following Chainguard pretty closely, and I'm been working in my spare time learning about SBOM and lower potential vulnerabilities in Docker images.

Chainguard advocates software supply chain security in this, so I'm also thinking we can at least follow what they're doing.

At the time I did this PR, Chainguard static image was not allowing other users to be used in the image.

Since then, I did find out that they have updated this to allow a certain limited range of users.

I'm still researching this, and we may or may not go this route immediately, but in the future, I would like to be able to use their images or at least a custom docker image.

Also, there is a slight discrepancies in some of the ditroless images across all meshery adapters, but it's not important now.

I still want to keep working on this.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @acald-creator. I see. As you said their base image is professional in security. Is there any limit(e.g, open-source License)? I saw they are a company who are in the container security industry.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Welcome to continue work on this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Aisuko Sorry for the delay in the response, but here is the link to Chainguard images at Apache 2.0 license.

https://github.com/chainguard-images/images/blob/main/LICENSE

I'm not aware of what Layer5 may have on what licenses to accept or not when using others' tools.

Copy link
Contributor Author

@acald-creator acald-creator May 6, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Azanul

At the time of opening this PR, Chainguard was building their images using apko and melange, and their base image which is now wolfi was not available at the time.

There were permissions issues because they changed the permissions for nonroot user in the static image, which could conflict with meshery-operator permissions.

I will have to revisit this to see if the Dockerfile builds as expected and works properly.

This comment was marked as outdated.

Sign in to view

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Azanul it was mentioned in this conversation block, changing from FROM gcr.io/distroless/static:nonroot to FROM cgr.dev/chainguard/static:latest.

After I tracked the issue at Chainguard, they were working on updating the permissions for the static image, which has been updated since, but I have not tested this Dockerfile.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are ✅ with respect to licensing concerns.

This comment was marked as outdated.

Sign in to view

WORKDIR /
COPY --from=builder /workspace/manager .
USER nonroot:nonroot
Expand Down