Feedback: Add rootless (alpine) images #4617

[zc-devs]

#4617

the agent and server images should have a shell

No, production images should not have a shell.

In production just use the scratch one and for debugging if you need a shell use the alpine one. For everyday operation I dont see any reason to have a shell.

In production there is no need to have a shell for pure binary apps. It is a very common practice to switch images for debugging.

How often do you need to debug your apps? So yes I do this every time I have to debug something. Tracing network issues can be done outside of the container itself, logs can be written to a volume or even better stdout etc.

Unless a different USER is set, root is being used. Also the directories are owned by root.

OK, fix scratch image. Set USER in dockerfile and fix directories permissions.

yet all operations are done as root

By default? I run with runAsNonRoot and readOnlyRootFilesystem (https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).

Rootless alpine should just replace the existing alpine variant.

Then you cannot simply install debug utilities from inside a container (apk add), you have to run it under root before. It is not so convenient.

---

I would

1. rename alpine to debug keeping root privileges
2. fix permissions in scratch image and optionally run it under unprivileged user by default

PS

@pat-s, you should have blocked me from within organization settings ;)