Use distroless image as the base image, run Katib components as a non-root user
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 542
- PR merge metrics
- No merged PRs in 30d
Description
/kind discussion
Once the ephemeral debug containers feature is available by default, we might better change the base image from the alpine to the distroless image, run Katib components as a non-root user.
Ref:
- https://github.com/kubeflow/katib/pull/1662#discussion_r706635579
- [Debugging with an ephemeral debug container
](https://kubernetes.io/docs/tasks/debug-application-cluster/debug-running-pod/#ephemeral-container)
Contributor guide
Research direction
Review the discussion in PR #1662 and the linked Kubernetes documentation on ephemeral debug containers first. Then identify the Katib component images and runtime user settings; completion requires distroless bases and non-root execution once ephemeral debug containers are available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100