Skip to content

fix(docker): build agent static on distroless/static and patch the custodian image #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gusfcarvalho merged 3 commits into from
Oct 29, 2026
Merged

fix(docker): build agent static on distroless/static and patch the custodian image #144

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e62a17e
fix(docker): build agent static on distroless/static and patch the cu…
ccf-lisa[bot] Oct 29, 2026
cb67658
fix(docker): say which plugins are static in the agent Dockerfile com…
ccf-lisa[bot] Oct 29, 2026
511f32c
Merge origin/main into fix/static-images
ccf-lisa[bot] Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,11 @@ RUN go mod download
COPY . .

ARG VERSION=dev
RUN go build -ldflags "-X main.version=${VERSION}" -o concom main.go
# Static binary, as .goreleaser.yaml builds it: nothing in the agent needs cgo, and CCF's plugins are static too.
RUN CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o concom main.go

FROM gcr.io/distroless/base-debian12@sha256:fabbf1c0c357a3d42550111351daed089b20a2c954df13ee2fcff60602515e84 AS final
# distroless/static has no libc or libssl to patch (agent-action copies /app/concom out of this image).
FROM gcr.io/distroless/static-debian12:latest@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2 AS final

WORKDIR /app
COPY --from=builder /app/concom /app/concom
Expand Down
2 changes: 1 addition & 1 deletion Dockerfile-ci
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ RUN go mod download
COPY . .

ARG VERSION=dev
RUN go build -ldflags "-X main.version=${VERSION}" -o concom main.go
RUN CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o concom main.go

FROM debian:bookworm-slim@sha256:99c0b25c46d0214d5a2091092e7908907dcaecd6a962cde0ac700acee222b6f3 AS final

Expand Down
18 changes: 17 additions & 1 deletion Dockerfile-custodian
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,29 @@ RUN go mod download
COPY . .

ARG VERSION=dev
RUN go build -ldflags "-X main.version=${VERSION}" -o concom main.go
# Static binary, so it doesn't depend on the c7n image's glibc (Ubuntu's, older than the builder's Debian).
RUN CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o concom main.go


FROM cloudcustodian/c7n:0.9.52.0@sha256:44cb9106961e57363b190be0bb6a07010a08f9e8a192ecc3273c5d58e7fcc131

COPY --from=builder /app/concom /app/concom

# Patch the fixable HIGH/CRITICAL Python findings c7n's image ships (the CI image check lists them).
# c7n's venv is uv's and has no pip, so uv is mounted for this step only. Drop each pin once a c7n
# release ships that version or newer. Ubuntu's pip/setuptools wheels only serve `python3 -m venv`.
USER root
RUN --mount=from=ghcr.io/astral-sh/uv:0.13.6@sha256:af22a52f5eafef3d78e551599d405c02df61919d18028f0cea8eda93bc9986d0,source=/uv,target=/usr/local/bin/uv \
uv pip install --python /src/.venv/bin/python --no-cache \
aiohttp==3.14.4 \
certifi==2026.10.19 \
oauthlib==4.0.0 \
pyjwt==2.15.0 \
urllib3==2.8.0 \
&& apt-get purge -y python3-pip-whl python3-setuptools-whl \
&& rm -rf /var/lib/apt/lists/*
USER custodian

WORKDIR /app
ENTRYPOINT ["/app/concom"]
CMD ["agent", "-c", "/app/config.yml"]
Loading