Default to binarySource=install

[rarkins]

What would you like Renovate to be able to do?

Default to binarySource=install behavior, mainly for the flow-on benefit in the renovate/renovate image.

If you have any ideas on how this should be implemented, please tell us here.

Change the default in a major release. Make sure that non-buildpack users don't get confusing warnings.

Is this a feature you are interested in implementing yourself?

Maybe

[rarkins]

@viceice do you think this makes most sense in Renovate itself, or in the Docker image?

Maybe it's best to have our docs showing the actual defaults in our image, which would mean doing it here. Then we just need to make sure that it gracefully downgrades to global if in non-buildpack.

[viceice]

I think we should do it here in a major bump. We should also extend the docs to explain the different settings a little bit more.

[or-adar]

Hi @rarkins and @viceice,
I've read about binarySource=install & binarySource=docker in the docs, and it looks like there are several approaches to let Renovate use the appropriate dependencies a repository needs (like suitable npm & node versions).
While using binarySource=docker with renovate/renovate:slim is recommended on your documents for setting a Self Hosted instance in GitLab, it looks like using renovate/renovate image with binarySource=install is much easier to set up for my needs (as I also need some internal certificates to have there).
Just wanted to ask if it's safe to use renovate/renovate image with binarySource=install for updating dependencies with different constraints?

[rarkins]

Yes, it's safe, but the list of supported managers so far is short (npm, yarn, composer). Not yet to language level like node and python

[Shegox]

Just wanted to add that we used binarySource=install with the full docker image over the last months without any problems and this solved quite a large problem with different package-lock versions.

[maxbrunet]

The release notes should indicate that Renovate will not work with a read-only filesystem anymore (including the container-base image). Otherwise, this could surprise some users, I have run it with that extra security setting myself

[rarkins]

@maxbrunet could you suggest the wording for this? I guess users can still switch back to binarySource=global if so too?

[maxbrunet]

Maybe

Renovate now requires a writable root filesystem in order to install binaries at runtime. For example, in Kubernetes, if you still wish to use container securityContext options like readOnlyRootFilesystem: true or a GID different from 0 (root) via runAsGroup, you can set binarySource=global to restore the old behavior.

(verbose version)

[HonkingGoose]

I think we can simplify a bit, and fix the styling as well:

Renovate now needs a writable root filesystem to install binaries at runtime.
For example, in Kubernetes, if you still wish to use container `securityContext` options like `readOnlyRootFilesystem: true` or a GID different from `0` (root) via `runAsGroup`, you can set `binarySource=global` to restore the old behavior.

[renovate-release]

🎉 This issue has been resolved in version 33.0.0 🎉

The release is available on:

• GitHub release
• 33.0.0

Your semantic-release bot 📦🚀