Skip to content

refactor(Dockerfile): use ghcr.io/linkerd/proxy base image #4334

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cratelyn merged 1 commit into from
Jan 16, 2026
Merged

refactor(Dockerfile): use ghcr.io/linkerd/proxy base image #4334

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 2 additions & 18 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,6 @@ ARG RUST_IMAGE=ghcr.io/linkerd/dev:v48-rust
# identity-initializing and linkerd-await wrappers.
ARG LINKERD2_IMAGE=ghcr.io/linkerd/proxy:edge-25.11.3

FROM $LINKERD2_IMAGE as linkerd2

FROM --platform=$BUILDPLATFORM $RUST_IMAGE as fetch

ARG PROXY_FEATURES=""
Expand Down Expand Up @@ -49,21 +47,7 @@ RUN --mount=type=cache,id=cargo,target=/usr/local/cargo/registry \
mv $(just --evaluate profile="$PROFILE" _target_bin) /out/ ; \
du -sh /out/* )

# Install the proxy binary into a base image that we can at least get a shell
# for debugging.
FROM docker.io/library/debian:bookworm-slim as runtime

RUN apt-get update && \
apt-get install -y iptables libcap2-bin && \
rm -rf /var/lib/apt/lists/*

WORKDIR /linkerd
COPY --from=linkerd2 /usr/lib/linkerd/* /usr/lib/linkerd/
# Install the proxy binary into the proxy image.
FROM $LINKERD2_IMAGE as linkerd2
COPY --from=build /out/* /usr/lib/linkerd/

USER root
RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/sbin/xtables-legacy-multi"]
RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/sbin/xtables-nft-multi"]
RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/lib/linkerd/linkerd2-proxy-init"]

ENTRYPOINT ["/usr/lib/linkerd/linkerd2-proxy-identity"]