containers: Move more Dockerfiles to be based on distroless#35631
Merged
def- merged 1 commit intoMaterializeInc:mainfrom Mar 26, 2026
Merged
containers: Move more Dockerfiles to be based on distroless#35631def- merged 1 commit intoMaterializeInc:mainfrom
def- merged 1 commit intoMaterializeInc:mainfrom
Conversation
Contributor
|
Thanks for opening this PR! Here are a few tips to help make the review process smooth for everyone. PR title guidelines
Pre-merge checklist
|
def-
changed the title
def-
force-pushed
the
pr-distroless-mroe
branch
9 times, most recently
from
9c7c3b0 to
56795d9
Compare
Contributor
There was a problem hiding this comment.
It seems like we need additional changes for the orchestratord tests to pass. I assume these aren't coming up at all. I see in the cloud test describe output that environmentd has exit code 127, so we're probably trying to call something that doesn't exist.
[pod/environmentd-0/environmentd] environmentd: error while loading shared libraries: liblzma.so.5: cannot open shared object file: No such file or directory
I also suspect we will need additional changes to support ssh tunnels, since distroless doesn't ship ssh by default, and that likely relies on other libs (openssl?) which likely don't exist either. That's the only thing I know off the top of my head that we subprocess out to in environmentd/clusterd, but database folks may know others.
def-
force-pushed
the
pr-distroless-mroe
branch
3 times, most recently
from
b4239bf to
328f4b5
Compare
def-
force-pushed
the
pr-distroless-mroe
branch
from
328f4b5 to
46a7f0b
Compare
Contributor
Author
|
Indeed, environmentd & clusterd turned out to be too complex, so I gave up on them. |
def-
force-pushed
the
pr-distroless-mroe
branch
from
46a7f0b to
a839800
Compare
alex-hunt-materialize
approved these changes
Mar 26, 2026
jasonhernandez
added a commit
to jasonhernandez/materialize
that referenced
this pull request
Apr 10, 2026
During rolling upgrades, orchestratord may manage pods running old Ubuntu-based images (uid/gid 999 `materialize` user) alongside new distroless images (uid/gid 65534 `nonroot` user). Gate the PodSecurityContext uid/gid based on the image version to prevent permission mismatches: - environmentd/clusterd: use meets_minimum_version(V26_20_0) to select 65534 for distroless images, 999 for older Ubuntu-based images - balancerd: parse the image ref directly (balancerd switched to distroless in v26.19 via MaterializeInc#35631, earlier than environmentd/clusterd) - Make parse_image_ref public for reuse by the balancer controller Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
jasonhernandez
added a commit
to jasonhernandez/materialize
that referenced
this pull request
Apr 10, 2026
During rolling upgrades, orchestratord may manage pods running old Ubuntu-based images (uid/gid 999 `materialize` user) alongside new distroless images (uid/gid 65534 `nonroot` user). Gate the PodSecurityContext uid/gid based on the image version to prevent permission mismatches: - environmentd/clusterd: use meets_minimum_version(V26_20_0) to select 65534 for distroless images, 999 for older Ubuntu-based images - balancerd: parse the image ref directly (balancerd switched to distroless in v26.19 via MaterializeInc#35631, earlier than environmentd/clusterd) - Make parse_image_ref public for reuse by the balancer controller Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
jasonhernandez
added a commit
that referenced
this pull request
Apr 15, 2026
During rolling upgrades, orchestratord may manage pods running old Ubuntu-based images (uid/gid 999 `materialize` user) alongside new distroless images (uid/gid 65534 `nonroot` user). Gate the PodSecurityContext uid/gid based on the image version to prevent permission mismatches: - environmentd/clusterd: use meets_minimum_version(V26_20_0) to select 65534 for distroless images, 999 for older Ubuntu-based images - balancerd: parse the image ref directly (balancerd switched to distroless in v26.19 via #35631, earlier than environmentd/clusterd) - Make parse_image_ref public for reuse by the balancer controller Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
jasonhernandez
added a commit
that referenced
this pull request
Apr 15, 2026
During rolling upgrades, orchestratord may manage pods running old Ubuntu-based images (uid/gid 999 `materialize` user) alongside new distroless images (uid/gid 65534 `nonroot` user). Gate the PodSecurityContext uid/gid based on the image version to prevent permission mismatches: - environmentd/clusterd: use meets_minimum_version(V26_20_0) to select 65534 for distroless images, 999 for older Ubuntu-based images - balancerd: parse the image ref directly (balancerd switched to distroless in v26.19 via #35631, earlier than environmentd/clusterd) - Make parse_image_ref public for reuse by the balancer controller Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
balancerd: 56MB -> 23MB
fivetran-destination: 49MB -> 16MB
Similar to #35595