Dockerfile based on chainguard/static leads to lack of shell and apk.

[hooUmAi]

In #3589 , the base image in the Dockerfile is replaced with chainguard/static, which doesn't contain a shell or apk. This change seems to make it difficult or impossible to add custom software such as curl for healthcheck or modify entrypoint and command for startup behavior customization. Is this the expected behavior? Are users with similar needs expected to have to write their own Dockerfiles and build images from scratch?

[mmmray]

I wondered if this was going to happen, so I looked through the various public docker-compose and saw that healthchecks were not particularly popular.

I would say that "availability of apk" should not be a promise xray makes, but we it can support usecases like "healthchecks" or some other specific customization.

It should also not be necessary to build a custom image. You can mount a statically-linked curl into the container as a volume, and it should work fine.

Where do you send healthchecks to? some random inbound?

[mmmray]

okay, that's almost a different topic. it seems to me it is much better to observe xray's memory usage and restart it at some threshold before it stops working. or restart it every N minutes

[hooUmAi]

This suggestion feels good, can you give some specific tips on how to implement it?
Also for some reason I would like to log the date every time I restart the xray automatically or manually. Previously I was able to do this by modifying the entrypoint and command to run a script in the container beforehand like this:

entrypoint: /bin/sh
command: -c "echo $$(date) > /etc/xray/startTime && /usr/bin/xray -confdir /etc/xray"

This can't be done now, do you have any suggestions for this?

[mmmray]

when I encounter a memory leak I go into the host's crontab and add docker-compose restart xray as a cronjob, i generally don't mess with the container commands unless I have to.

[hooUmAi]

But that doesn't seem particularly consistent with your earlier reference to "observe xray's memory usage and restart it at some threshold"?

[mmmray]

you can use ps or pmap to get the memory usage, for example pmap -x $(pidof xray), this can be run from outside the container. based on that you can make a decision

[Meo597]

@hooUmAi

作为抗审查工具，有必要尽可能减少 CVE 来降低攻击面
rootless 和 shell-less 应该是必选项而不是可选项

最新版的已经 rootless 并作了细致的目录和文件权限

---

关于重启记录，新版的 docker 映像已经默认记录 WARN 级别日志，它在 /var/log/xray/error.log 中能反映出 Xray 的重启情况

---

关于健康检查，目前没有实现，感觉也没什么必要性
你永远不应该依赖 shell 实现它，你应该用 Dockerfile

下面是伪代码：

FROM ghcr.io/xtls/xray-core:latest
COPY curl xxxxxxxxxxx........
HEALTHCHECK --interval=5s --timeout=3s  --retries=3 \
   CMD xxxxxxxxxxx....... || exit 1