Skip to content
This repository was archived by the owner on Jun 4, 2024. It is now read-only.

Update base docker images to use Debian 12 distroless static image#928

Merged
reedloden merged 1 commit intomasterfrom
reed/distroless-debian12
Sep 26, 2023
Merged

Update base docker images to use Debian 12 distroless static image#928
reedloden merged 1 commit intomasterfrom
reed/distroless-debian12

Conversation

@reedloden
Copy link
Copy Markdown
Contributor

@reedloden reedloden commented Sep 25, 2023

Instead of chasing ever-changing commit hashes, just use the apppropriate tag for the distroless image. This aligns things to how teleport is handled (gravitational/teleport#31620).

Additionally, standardize on Debian 12 for everything (instead of a mix of 11 and 12). Also, use static over base. This means no glibc or libssl, which should be fine for these plugins.

Alternative to #924 and #915.

@reedloden reedloden added release-engineering Related to release engineering security Security Issues labels Sep 25, 2023
@reedloden reedloden requested a review from wadells September 25, 2023 22:13
@reedloden reedloden self-assigned this Sep 25, 2023
@reedloden reedloden force-pushed the reed/distroless-debian12 branch from 6d64f30 to edc30fd Compare September 26, 2023 02:25
@reedloden reedloden changed the title Update base docker images to use Debian 12 distroless base image Update base docker images to use Debian 12 distroless static image Sep 26, 2023
Instead of chasing ever-changing commit hashes, just use the apppropriate
tag for the distroless image. This aligns things to how `teleport` is handled.

Additionally, standardize on Debian 12 for everything (instead of a mix of 11 and 12).

Alternative to #924 and #915.
@reedloden reedloden force-pushed the reed/distroless-debian12 branch from edc30fd to b02a444 Compare September 26, 2023 02:29
@reedloden reedloden merged commit efa67e1 into master Sep 26, 2023
@reedloden reedloden deleted the reed/distroless-debian12 branch September 26, 2023 02:35
@espadolini
Copy link
Copy Markdown
Contributor

This broke public.ecr.aws/gravitational/teleport-plugin-slack:14.0.1 because the binary inside is very much not static:

teleport-plugin: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, Go BuildID=sb62wjCeHYTZN85Ku79e/28AjXaQ3faKD7cS4g4oB/AANtv5x_00Dhqk0pNj65/Zzx2amhxFyifyIEYnEzk, stripped

reedloden added a commit that referenced this pull request Sep 29, 2023
The change to distroless static in #928 broke plugin binaries, as the distroless image
doesn't have glibc. However, there's no reason for the plugins to need glibc,
so just change them to all `CGO_BUILD=0`.

Additionally, fix one place where `GO_VERSION` wasn't properly set/updated.

Fixes #935.
reedloden added a commit that referenced this pull request Sep 29, 2023
The change to distroless static in #928 broke plugin binaries, as the distroless image
doesn't have glibc. However, there's no reason for the plugins to need glibc,
so just change them to all `CGO_ENABLED=0`.

Additionally, some minor fixes:
* Change one place where `GO_VERSION` wasn't properly set/updated.
* Correct build process for `access/email`.
* Remove reference to previously removed `access/example`.

Fixes #935.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

release-engineering Related to release engineering security Security Issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants