[WIP] Add alternative debian based base image #7593

rikatz · 2021-09-04T04:38:52Z

Fixes partially: #7518
This is also an attempt to optimize / solve coredumps problems in #6896

On an attempt to solve random coredump problems, and have some standard image building this PR:

Changes the base image from Alpine to Debian
Splits the base image in two: nginx and mod_security

The old all in one alpine image got 184Mb, while the new images got 164mb (base NGINX) and 77.9Mb (modsecurity).

Although the sum of the images grows (mostly due to glibc and not optimizing Debian Image the same way it's done in https://github.com/kubernetes/release/tree/master/images/build/debian-base/bullseye, still the reduction for the majority of users will be 20Mb (as modsecurity is going to be optional now)

Before merging this PR, we should wait for kubernetes/test-infra#23478 to get merged

k8s-ci-robot · 2021-09-04T04:38:59Z

@rikatz: This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2021-09-04T04:39:18Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rikatz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~images/OWNERS~~ [rikatz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tao12345666333

leave some comments.

images/modsecurity/Makefile

tao12345666333 · 2021-09-04T14:23:40Z

images/modsecurity/cloudbuild.yaml

@@ -0,0 +1,24 @@
+timeout: 10800s


Should we add license header?

Cloud build files don't have license header (no idea why)

https://github.com/kubernetes/ingress-nginx/blob/main/cloudbuild.yaml

tao12345666333 · 2021-09-04T14:25:24Z

images/modsecurity/cloudbuild.yaml

+  _GIT_TAG: "12345"
+  _PULL_BASE_REF: "master"


These lines should be updated?

Nope, this is somehow the way cloudbuild understands this

tao12345666333 · 2021-09-04T14:30:58Z

images/modsecurity/rootfs/build.sh

+export BUILD_PATH=/tmp/build
+
+#  TODO: Verify and add the same libraries (but not dev) in main container
+apt-get install -y \


we should runapt-get update before this.

Or execute before this script， like the Dockerfile 👆

apt-get has a --no-install-recommends flag, we can use it to reduce install packages.

Though I was using --no-install-recommends (actually I am, in debian image...)

Will review all again :)

Hum I remember now why I didn't added --no-install-recommends here: because modsecurity building is kind of annoying, and we are just using this image to copy the end result (libmodsecurity) to the other image (which is properly a busybox).

Do you think still we should do a --no-install-recommends? About the update I agree, should always update the builder image

Do you think still we should do a --no-install-recommends?

Based on the reasons you mentioned above, I think it is not necessary to add --no-install-recommends flag

Maybe we can move forward

clementnuss · 2021-09-07T09:32:02Z

Is the image already available for download ? I'm interested in testing it, due to the infamous musl-libc/lua nginx crashes.
Tried to search it but only managed to download the alpine based nginx(-controller) images

Thanks for your work 👏🏻

rikatz · 2021-09-07T17:15:06Z

Is the image already available for download ? I'm interested in testing it, due to the infamous musl-libc/lua nginx crashes.
Tried to search it but only managed to download the alpine based nginx(-controller) images

Thanks for your work 👏🏻

It's a WIP yet and we are waiting the test-infra promoter part to work.

I will fix some things here and can generate an image locally, if you want to test :)

rikatz · 2021-09-07T17:15:26Z

Damn clicked wrong on button, sorry

rikatz · 2021-09-07T17:18:56Z

images/modsecurity/rootfs/Dockerfile

@@ -0,0 +1,27 @@
+# Copyright 2015 The Kubernetes Authors. All rights reserved.


changed the year here

rikatz · 2021-09-07T17:19:45Z

images/nginx-debian/Makefile

@@ -0,0 +1,57 @@
+# Copyright 2017 The Kubernetes Authors. All rights reserved.


rikatz · 2021-09-07T17:19:56Z

images/nginx-debian/rootfs/Dockerfile

@@ -0,0 +1,68 @@
+# Copyright 2015 The Kubernetes Authors. All rights reserved.


rikatz · 2021-09-07T17:20:21Z

images/nginx-debian/rootfs/build.sh

@@ -0,0 +1,606 @@
+#!/bin/bash
+
+# Copyright 2015 The Kubernetes Authors.


Also here...

rikatz · 2021-09-07T19:10:29Z

@tao12345666333 the staging push job is merged.

As soon as you think this is good and gets merged, we can start using the image in staging bucket to write some e2e tests and maybe release a non official debian image so folks can test :)

k8s-triage-robot · 2021-12-06T19:33:14Z

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

tao12345666333 · 2021-12-07T06:16:40Z

/remove-lifecycle stale

Add alternative debian based base image

337782f

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Sep 4, 2021

k8s-ci-robot added needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. needs-priority size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Sep 4, 2021

k8s-ci-robot requested review from bowei and ElvinEfendi September 4, 2021 04:39

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 4, 2021

rikatz mentioned this pull request Sep 4, 2021

Optimize Image generation #7518

Closed

2 tasks

rikatz requested review from strongjz and tao12345666333 and removed request for bowei September 4, 2021 04:49

tao12345666333 reviewed Sep 4, 2021

View reviewed changes

rikatz closed this Sep 7, 2021

rikatz reopened this Sep 7, 2021

rikatz commented Sep 7, 2021

View reviewed changes

Change the headers to correct year

34051c2

sepich mentioned this pull request Sep 10, 2021

Worker Segmentation Fault (v0.44.0) #6896

Closed

rikatz mentioned this pull request Sep 26, 2021

add OpenTelemetry to nginx base image #7669

Merged

dmathieu mentioned this pull request Dec 6, 2021

First sidecar module: OpenTelemetry #8013

Merged

9 tasks

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 6, 2021

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 7, 2021

rikatz closed this Dec 30, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] Add alternative debian based base image #7593

[WIP] Add alternative debian based base image #7593

rikatz commented Sep 4, 2021 •

edited

Loading

k8s-ci-robot commented Sep 4, 2021

k8s-ci-robot commented Sep 4, 2021

tao12345666333 left a comment

tao12345666333 Sep 4, 2021

rikatz Sep 5, 2021

tao12345666333 Sep 4, 2021

rikatz Sep 5, 2021

tao12345666333 Sep 4, 2021

tao12345666333 Sep 4, 2021

rikatz Sep 5, 2021

rikatz Sep 5, 2021

tao12345666333 Sep 7, 2021

tao12345666333 Sep 7, 2021

clementnuss commented Sep 7, 2021

rikatz commented Sep 7, 2021

rikatz commented Sep 7, 2021

rikatz Sep 7, 2021

rikatz Sep 7, 2021

rikatz Sep 7, 2021

rikatz Sep 7, 2021

rikatz commented Sep 7, 2021

k8s-triage-robot commented Dec 6, 2021

tao12345666333 commented Dec 7, 2021

		@@ -0,0 +1,27 @@
		# Copyright 2015 The Kubernetes Authors. All rights reserved.

		@@ -0,0 +1,57 @@
		# Copyright 2017 The Kubernetes Authors. All rights reserved.

		@@ -0,0 +1,68 @@
		# Copyright 2015 The Kubernetes Authors. All rights reserved.

		@@ -0,0 +1,606 @@
		#!/bin/bash

		# Copyright 2015 The Kubernetes Authors.

[WIP] Add alternative debian based base image #7593

[WIP] Add alternative debian based base image #7593

Conversation

rikatz commented Sep 4, 2021 • edited Loading

k8s-ci-robot commented Sep 4, 2021

k8s-ci-robot commented Sep 4, 2021

tao12345666333 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

clementnuss commented Sep 7, 2021

rikatz commented Sep 7, 2021

rikatz commented Sep 7, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rikatz commented Sep 7, 2021

k8s-triage-robot commented Dec 6, 2021

tao12345666333 commented Dec 7, 2021

rikatz commented Sep 4, 2021 •

edited

Loading