fix: switch to distroless, fix cves#33
Conversation
|
@zvonkok @cdesiniotis PTAL. |
Signed-off-by: Joji Mekkattuparamban <jojim@nvidia.com>
| COPY --from=builder /build/gpu-admin-tools /app/gpu-admin-tools | ||
|
|
||
| # Copy rm for the preStop hook | ||
| COPY --from=stg2 /busybox/rm /bin |
There was a problem hiding this comment.
Usually, busybox has symlinks for tools to the busybox binary. Is COPY doing the right thing here?
There was a problem hiding this comment.
This is true. Because the busybox is named rm within the container, it just works. Do you see any issue with this approach? If so, I can look at alternatives.
There was a problem hiding this comment.
No was just curious how it is handled in the distroless container. If it works then all good.
There was a problem hiding this comment.
I am not following why we are making this change, and how it differs from just using the distroless -dev tag as our base. My understanding is the distroless-dev tags include busybox and the sleep command. If we end up copying the busybox binary to the final image (as is done here), isn't the final SBOM nearly the same?
Please let me know if I am missing something.
There was a problem hiding this comment.
@cdesiniotis It does differ because the binary relies on the name to determine its persona (i.e. rm vs ls etc). However, I concluded it might be a security risk and decided to build rm from source instead.
| COPY --from=builder /build/gpu-admin-tools /app/gpu-admin-tools | ||
|
|
||
| # Copy rm for the preStop hook | ||
| COPY --from=stg2 /busybox/rm /bin |
There was a problem hiding this comment.
I am not following why we are making this change, and how it differs from just using the distroless -dev tag as our base. My understanding is the distroless-dev tags include busybox and the sleep command. If we end up copying the busybox binary to the final image (as is done here), isn't the final SBOM nearly the same?
Please let me know if I am missing something.
|
@cdesiniotis yes, I am looking at options to eliminate copying the busybox applet. Will update. |
Signed-off-by: Joji Mekkattuparamban <jojim@nvidia.com>
Signed-off-by: Joji Mekkattuparamban <jojim@nvidia.com>
zvonkok
left a comment
zvonkok
left a comment
There was a problem hiding this comment.
LGTM, depends on: NVIDIA/gpu-operator#2075
3 participants
Upgrade to new distroless, fix some CVEs.