dotnet / dotnet/docker-tools

Port Image Builder container image from Alpine to distroless Azure Linux

Open
#1,060 2 comments 0 reactions 0 assignees View on GitHub
area-dockerfiles enhancement epic
Dominant language
C#
Stars
181
Forks
67
Avg merge
2d 15h
Merged PRs (30d)
10

Description

This would help to validate the benefits of distroless, and Mariner in general (a good dogfooding effort).

Originally, this was thought to have been blocked by not having a docker package in Mariner but I've now realized what we need is the `moby-cli` package. This allows us to run docker commands targeting the docker daemon on the host machine, connected by the docker socket.

My initial investigation into this has revealed a lot of changes necessary for this.

Tasks to complete:

- [x] https://github.com/dotnet/docker-tools/issues/1392
- [ ] Remove dependency on git CLI
Currently Image Builder has a dependency on git for a single operation: to get the commit SHA of a file. Removing the dependency on the git CLI is useful because of the image size impact of including the `git` package in the image. It adds ~230 MB. The dependency on the git CLI can be replaced with equivalent logic that makes use of the libgit2sharp library which is already used.
- [ ] Refactor pipeline to not rely on volume mounted artifacts directory
As a result of running the container as a non-root user, that user does not have permission to write to [the artifacts directory that gets volume mounted into the container](https://github.com/dotnet/docker-tools/blob/5ba71de630094a461c186a2432f4f3eaea9b21bb/eng/common/templates/steps/init-docker-linux.yml#L41). This is a bit of tricky problem to solve that would add complexity to the system. Instead, it can be mitigated by removing the volume mount altogether. The use of volume mounting was only done as a convenience to get files out of the container, not to send files in. So the pipeline can be updated to just use `docker cp` to get those artifact files out of the container.
- [ ] Update Image Builder Dockerfile to be based on distroless Mariner

Related work:

- [ ] https://github.com/microsoft/CBL-Mariner/issues/3811
As a result of installing moby-cli, bash is also getting included. This issue was logged in hopes of being able to remove that since we don't want bash in a distroless container.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.