Skip to content

RED-181280 - support multiarch #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
almoggue merged 1 commit into from
Jan 12, 2026
Merged

RED-181280 - support multiarch #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 17 additions & 3 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,27 @@
FROM python:3.8
FROM python:3.11-bookworm
Copy link

@jit-ci jit-ci bot Dec 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security control: Docker Scan

Image User Should Not Be 'Root'

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

  • First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: docker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:
    • If a non-root user already exists in your container, consider using it.
    • If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.
Suggested change
FROM python:3.11-bookworm
FROM python:3.11-bookworm
RUN addgroup --system <group>
RUN adduser --system <user> --ingroup <group>
USER <user>:<group>
Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

  • #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
  • #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
  • #jit_ignore_type_in_file Ignore any finding of type "Image user should not be 'root'" in Dockerfile; future occurrences will also be ignored.
  • #jit_undo_ignore Undo ignore command

Copy link

@jit-ci jit-ci bot Jan 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security control: Docker Scan

Image User Should Not Be 'Root'

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Severity: HIGH

Learn more about this issue

Fix suggestion:

This fix suggestion was generated by Jit. Please note that the suggestion might not always fit every use case. It is highly recommended that you check and review it before merging.

Suggestion guidelines

  • First of all, check if your container is running as a root user. In most of the cases, you can do it by running a command like this: docker run <image> whoami. If it returns root, then you should consider using a non-root user, by following one of the next steps:
    • If a non-root user already exists in your container, consider using it.
    • If not, you can create a new user by adding a USER command to the Dockerfile, with a non-root user as argument, for example: USER <non-root-user-name>.
Suggested change
FROM python:3.11-bookworm
FROM python:3.11-bookworm
RUN addgroup --system <group>
RUN adduser --system <user> --ingroup <group>
USER <user>:<group>
Jit Bot commands and options (e.g., ignore issue)

You can trigger Jit actions by commenting on this PR review:

  • #jit_ignore_fp Ignore and mark this specific single instance of finding as “False Positive”
  • #jit_ignore_accept Ignore and mark this specific single instance of finding as “Accept Risk”
  • #jit_ignore_type_in_file Ignore any finding of type "Image user should not be 'root'" in Dockerfile; future occurrences will also be ignored.
  • #jit_undo_ignore Undo ignore command


# Docker automatically provides TARGETARCH (amd64, arm64, etc.) for multi-platform builds
ARG TARGETARCH
ARG MEMTIER_VERSION=2.1.1

ENV FLASK_APP app.py
ENV APP_SETTINGS settings.cfg
ENV NO_URL_QUOTING True

# Install memtier_benchmark from GitHub releases
# Downloads the appropriate .deb file based on target architecture
# Note: Version 2.1.1 is not available in the Redis APT repository, only on GitHub releases
RUN curl -fsSL -o /tmp/memtier-benchmark.deb \
"https://github.com/RedisLabs/memtier_benchmark/releases/download/${MEMTIER_VERSION}/memtier-benchmark_${MEMTIER_VERSION}.bookworm_${TARGETARCH}.deb" && \
apt-get update && \
apt-get install -y --no-install-recommends /tmp/memtier-benchmark.deb && \
rm /tmp/memtier-benchmark.deb && \
rm -rf /var/lib/apt/lists/* && \
memtier_benchmark --version

COPY . /app
WORKDIR /app

RUN pip install -r requirements.txt

RUN make memtier_benchmark

CMD python -m flask run -p 8080 -h 0.0.0.0
41 changes: 38 additions & 3 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,42 @@
push: memtier_benchmark
cf push

# Legacy target - no longer needed as memtier_benchmark is installed via APT in Dockerfile
memtier_benchmark:
wget https://s3.eu-central-1.amazonaws.com/redislabs-dev-public-deps/binaries/memtier_benchmark_1.2.15_xenial
mv memtier_benchmark_1.2.15_xenial memtier_benchmark
chmod +x memtier_benchmark
@echo "memtier_benchmark is now installed via APT package in the Docker image"
@echo "This target is kept for backward compatibility only"

# Docker multi-platform build targets
.PHONY: docker-build docker-buildx-setup docker-push

# Docker image configuration
# Usage: make docker-push TAG=v1.2.3
# To override image name: make docker-push IMAGE_NAME=myregistry/myimage TAG=v1.2.3
# To override memtier version: make docker-push TAG=v1.2.3 MEMTIER_VERSION=2.1.4
# WARNING: TAG is required for push commands to prevent accidental overwrites
IMAGE_NAME ?= redislabs/redis-webcli
TAG ?=
MEMTIER_VERSION ?= 2.1.1

# Setup buildx for multi-platform builds (run once)
docker-buildx-setup:
docker buildx create --name multiarch --use || docker buildx use multiarch
docker buildx inspect --bootstrap

# Build multi-platform image (AMD64 + ARM64)
docker-build:
docker buildx build --platform linux/amd64,linux/arm64 \
--build-arg MEMTIER_VERSION=$(MEMTIER_VERSION) \
-t $(IMAGE_NAME):$(TAG) .

# Build and push multi-platform image (requires TAG to be set)
docker-push:
@if [ -z "$(TAG)" ]; then \
echo "Error: TAG is required. Usage: make docker-push TAG=v1.2.3"; \
exit 1; \
fi
docker buildx build --platform linux/amd64,linux/arm64 \
--build-arg MEMTIER_VERSION=$(MEMTIER_VERSION) \
-t $(IMAGE_NAME):$(TAG) --push .


2 changes: 1 addition & 1 deletion app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ def __init__(self, master_ip, master_port, redis_password=None, argument_line=""
self._process = None

def run(self):
self._process = subprocess.Popen(["./memtier_benchmark", "-s", self._master_ip, "-p", self._master_port, "-a", self._redis_password] + self._argument_list,
self._process = subprocess.Popen(["memtier_benchmark", "-s", self._master_ip, "-p", self._master_port, "-a", self._redis_password] + self._argument_list,
stdout=subprocess.PIPE, stderr=subprocess.STDOUT, bufsize=1, shell=False)
while True:
curr_output = self._process.stdout.readline().decode("utf-8")
Expand Down