Skip to content

Update Dockerfile to use buster #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cpretzer merged 4 commits into from
Jul 14, 2020
Merged

Update Dockerfile to use buster #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6328e5f
Update Dockerfile to use buster
cpretzer Sep 18, 2019
90564a2
Update base image to buster-20200514-slim
cpretzer Jun 17, 2020
507950a
Use iptables-legacy for the init container
cpretzer Jun 18, 2020
73ca66d
Add volumes and volumeMount keys to test yaml
cpretzer Jul 14, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,14 @@ ARG TARGETARCH
RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -o /out/linkerd2-proxy-init -mod=readonly -ldflags "-s -w" -v

## package runtime
FROM --platform=$TARGETPLATFORM debian:stretch-20190812-slim
FROM --platform=$TARGETPLATFORM debian:buster-20200514-slim
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
iptables \
Copy link
Contributor

@joakimr-axis joakimr-axis Jun 8, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Try adding

RUN update-alternatives --set iptables /usr/sbin/iptables-legacy \
    && update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy

here to make current use of iptables work with buster.
(See linkerd/linkerd2#4567 for more info.)

procps \
&& rm -rf /var/lib/apt/lists/*
&& rm -rf /var/lib/apt/lists/* \
&& update-alternatives --set iptables /usr/sbin/iptables-legacy \
&& update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
COPY LICENSE /linkerd/LICENSE
COPY --from=golang /out/linkerd2-proxy-init /usr/local/bin/proxy-init
ENTRYPOINT ["/usr/local/bin/proxy-init"]
18 changes: 18 additions & 0 deletions integration_test/iptables/iptablestest-lab.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,12 @@ spec:
readOnlyRootFilesystem: true
runAsNonRoot: false
runAsUser: 0
volumeMounts:
- mountPath: /run
name: linkerd-proxy-init-xtables-lock
volumes:
- emptyDir: {}
name: linkerd-proxy-init-xtables-lock
---
apiVersion: v1
kind: Service
Expand Down Expand Up @@ -132,6 +138,12 @@ spec:
readOnlyRootFilesystem: true
runAsNonRoot: false
runAsUser: 0
volumeMounts:
- mountPath: /run
name: linkerd-proxy-init-xtables-lock
volumes:
- emptyDir: {}
name: linkerd-proxy-init-xtables-lock
---
apiVersion: v1
kind: Pod
Expand Down Expand Up @@ -188,3 +200,9 @@ spec:
readOnlyRootFilesystem: true
runAsNonRoot: false
runAsUser: 0
volumeMounts:
- mountPath: /run
name: linkerd-proxy-init-xtables-lock
volumes:
- emptyDir: {}
name: linkerd-proxy-init-xtables-lock