use minimal base docker image #2196
Conversation
k8s-ci-robot
added
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: M00nF1sh The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
| @@ -1,6 +1,6 @@ | |||
| # syntax=docker/dockerfile:experimental | |||
|
|
|||
| FROM --platform=${BUILDPLATFORM} golang:1.16.3 AS base | |||
| FROM --platform=${TARGETPLATFORM} golang:1.16 AS base | |||
There was a problem hiding this comment.
why is the change in the golang version?
There was a problem hiding this comment.
to be consistent with our go.mod.
this will make sure we are using latest golang 1.16 series for new builds
|
|
||
| COPY --from=build /out/controller /controller | ||
| USER 1002 |
There was a problem hiding this comment.
Is this included in the base image?
There was a problem hiding this comment.
yes, the nonroot base image have a different USER set.
https://github.com/aws/eks-distro-build-tooling/blob/main/eks-distro-base/Dockerfile.minimal#L83
kishorj
added
the
tide/merge-method-squash
Codecov Report
@@ Coverage Diff @@
## main #2196 +/- ##
=======================================
Coverage 52.29% 52.29%
=======================================
Files 132 132
Lines 7234 7234
=======================================
Hits 3783 3783
Misses 3157 3157
Partials 294 294 Continue to review full report at Codecov.
|
|
/lgtm |
k8s-ci-robot
added
the
lgtm
Issue
Description
Use a minimal base image for AWSLoadBalancerController docker image.
The minimal base image contains minimal packages and don't have no shells, which reduce attack surface and help us avoid noises reported by image scanners.
Notes to reviewer:
-linkmode=external -extldflags '-static-pie'is added to provide a static-pie, our prior builds produces a dynamically-linked binary post golang 1.15.-tags 'osusergo,netgo,static_build'instructs the golang to use the go version of os/user and net packages instead of CGO.--platform=${TARGETPLATFORM}instead of--platform=${BUILDPLATFORM}, which is required to provide multi-arch binaries in OSX. Our internal pipeline is not affected given different arch building separately in different OS.Checklist
README.md, or thedocsdirectory)BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯