chore: migrate base images to Chainguard - #1
Open
sachin-spotdraft wants to merge 1 commit into
Open
Conversation
Replace public base images with Chainguard equivalents from cgr.dev/spotdraft.com. - Uses -fips variants where available - Build stages use :latest-dev (shell available) - Runtime stages use :latest (minimal) - Platform pinned to linux/amd64
![baz-reviewer[bot]](https://avatars.githubusercontent.com/in/933528?s=60&v=4){kind=small}
| @@ -1,4 +1,4 @@ | |||
| FROM golang:1.11.10-alpine as builder | |||
| FROM --platform=linux/amd64 cgr.dev/spotdraft.com/go:1.11.10-dev as builder | |||
There was a problem hiding this comment.
The new cgr.dev/spotdraft.com/go:1.11.10-dev image runs as non-root (UID 65532) by default, so the apk update && apk add ... step fails, which blocks the later addgroup/adduser and go build -o /grpcui steps — should we add USER root before this setup and switch back afterward, or use an image whose default user is root?
Want Baz to fix this for you? Activate Fixer
Prompt for AI Agents
Before applying, verify this suggestion against the current code. In Dockerfile around
lines 1-4 (builder stage), the base image was changed to
`cgr.dev/spotdraft.com/go:1.11.10-dev` whose default user is nonroot (UID 65532), but
the Dockerfile runs `apk update && apk add ...` and `addgroup`/`adduser` before any
`USER root`, so package installation fails and the later steps (creating users/groups,
copying /etc/ssl/certs/ca-certificates.crt and /etc/passwd into the scratch stage, and
`go build -o /grpcui`) never run. Add `USER root` immediately before the first `apk`
command, then switch back to the nonroot user after setup is complete (before `go build`
and any runtime setup), ensuring the scratch-copy steps still occur correctly.
Alternatively, if you prefer not to add user switching, replace the base image with one
whose default user is root.
Author
These Dockerfile lines were left unchanged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
Summary
cgr.dev/spotdraft.com:latest-dev(includes shell):latest(minimal, no shell)linux/amd64Images updated
See Dockerfile diffs above.
🤖 Generated by chainguard-migrate.sh
Generated description
Below is a concise technical summary of the changes proposed in this PR:
Migrate the Go builder stage from the public Alpine-based image to Chainguard’s
cgr.dev/spotdraft.com/go:1.11.10-devimage. Pin the build platform tolinux/amd64while retaining the shell-enabled development image needed for compilation.Latest Contributors(2)