Skip to content
This repository was archived by the owner on Dec 15, 2020. It is now read-only.

Harden Docker container #2153

Open
hazcod wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Harden Docker container #2153

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
67e653c
chore(make): produce go static builds
hazcod Nov 13, 2019
cec0512
feat(docker): use distroless
hazcod Nov 13, 2019
6c05991
chore(docker): use correct label
hazcod Nov 13, 2019
c2b1f2c
fix(docker): use static
hazcod Nov 13, 2019
a189867
fix(cicd): use go 1.13.4
hazcod Nov 13, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
FROM alpine
MAINTAINER Kolide Developers <engineering@kolide.co>

RUN apk --update add ca-certificates
FROM gcr.io/distroless/base-debian10:nonroot
LABEL author Kolide Developers <engineering@kolide.co>
Comment thread
hazcod marked this conversation as resolved.
Outdated
USER nonroot

COPY ./build/binary-bundle/linux/fleet ./build/binary-bundle/linux/fleetctl /usr/bin/

CMD ["fleet", "serve"]
EXPOSE 8080
CMD ["/usr/bin/fleet", "serve"]
4 changes: 2 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,10 +107,10 @@ endif
build: fleet fleetctl

fleet: .prefix .pre-build .pre-fleet
go build -i -o build/${OUTPUT} -ldflags ${KIT_VERSION} ./cmd/fleet
go build -i -o build/${OUTPUT} -ldflags ${KIT_VERSION} -ldflags "-w -s -extldflags '-static'" ./cmd/fleet

@zwass zwass Nov 13, 2019

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this change necessary when using base-debian10? https://github.com/GoogleContainerTools/distroless/blob/master/base/README.md seems to suggest that this may not be needed.

@hazcod hazcod Nov 13, 2019

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Exactly right, I've changed it to static since it now receives glibc from the original go image used to built the code from .circleci/. Seems clearer

@zwass zwass Nov 17, 2019

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry it wasn't clear, but my preferred strategy would be to leave the build the same while using the base-debian10 image. Do you see a compelling reason to change the build flags for all binaries vs. using the base image?

@hazcod hazcod Nov 18, 2019

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zwass care to share your relationale behind that? Since distroless does not have an update policy, there is no guarantee when they pull in new glibc versions so it would make more sense to me to package that in during compilation. GoogleContainerTools/distroless#326

@zwass zwass Nov 20, 2019

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My rationale is that we are changing the build flags for all the binaries produced by this Makefile, not just those being placed in the Docker container. Maybe we can refactor the Makefile in such a way to enable the fully static build for the binary used in the container while leaving other binary builds unchanged?

@hazcod hazcod Nov 20, 2019 •
edited
Loading

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it would make more sense to build fleet in a multi-stage container, what do you think? So we can move GOOS=linux go build -i -o build/linux/${OUTPUT} -ldflags ${KIT_VERSION} ./cmd/fleet to the build container.

@zwass zwass Nov 20, 2019

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am on board with that strategy. It will likely require running make deps-js && make generate-js in a Node container, then make deps-go && make generate-go && make in a Go container.


fleetctl: .prefix .pre-build .pre-fleetctl
go build -i -o build/fleetctl -ldflags ${KIT_VERSION} ./cmd/fleetctl
go build -i -o build/fleetctl -ldflags ${KIT_VERSION} -ldflags "-w -s -extldflags '-static'" ./cmd/fleetctl

lint-js:
yarn run eslint frontend --ext .js,.jsx
Expand Down