feat: Use setpriv and rm gosu, use newer toolchain with dasel#858
feat: Use setpriv and rm gosu, use newer toolchain with dasel#858
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the InfluxDB 2.8 container images to remove gosu/su-exec and switch to setpriv for dropping root privileges, while changing how dasel is provided (built during image build rather than downloaded as a release artifact).
Changes:
- Replace
gosu/su-execwithsetprivin both Debian and Alpine entrypoints. - Add
setprivruntime dependencies (util-linuxon Debian,setprivpackage on Alpine) and remove thegosuinstall block. - Build and copy
daselvia a Go builder stage instead of downloading + SHA256-verifying release binaries.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
influxdb/2.8/entrypoint.sh |
Switch root step-down mechanism from gosu to setpriv. |
influxdb/2.8/Dockerfile |
Remove gosu, add util-linux for setpriv, and build dasel via Go builder stage. |
influxdb/2.8/alpine/entrypoint.sh |
Switch root step-down mechanism from su-exec to setpriv. |
influxdb/2.8/alpine/Dockerfile |
Remove su-exec, add setpriv, and build dasel via Go builder stage. |
Comments suppressed due to low confidence (1)
influxdb/2.8/alpine/Dockerfile:23
- The previous dasel install step included a build-time smoke test (
dasel --version). With the newCOPY --from=dasel-builderapproach, consider adding a simple version/executable check after the COPY so broken builder outputs are caught during image build rather than at runtime.
# Install dasel for configuration parsing, built with a current Go toolchain.
COPY --from=dasel-builder /go/bin/dasel /usr/local/bin/dasel
RUN addgroup -S -g 1000 influxdb && \
adduser -S -G influxdb -u 1000 -h /home/influxdb -s /bin/sh influxdb && \
mkdir -p /home/influxdb && \
chown -R influxdb:influxdb /home/influxdb
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…nfluxdata-docker into db/865/binary-cleanup
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
No description provided.