Skip to content

build(docker): переход runtime-образов на distroless и запуск от non-root #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
avlllo merged 3 commits into from
Oct 20, 2026
Merged

build(docker): переход runtime-образов на distroless и запуск от non-root #64

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d5dc748
build(docker): switch runtime images to distroless and run as non-root
dato-dev Oct 12, 2026
f07e85b
build(docker): drop gops CLI from runtime images
dato-dev Oct 12, 2026
f96c08d
build(docker): use runtime-radar-base as the non-root runner image
dato-dev Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions auth-center/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,13 @@ COPY go.mod go.sum ./
COPY vendor/ vendor/
ENV GOCACHE=/root/.cache/go-build

RUN --mount=type=cache,target="/root/.cache/go-build" \
mkdir -p bin && \
GOBIN=/go/src/repo/bin go install github.com/google/gops

COPY --from=tools /usr/bin/task /usr/bin
COPY auth-center/ auth-center/
COPY lib/ lib/

RUN --mount=type=cache,target="/root/.cache/go-build" task -d auth-center build

FROM debian:12.0-slim AS runner
FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner

LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
LABEL org.opencontainers.image.description="Auth center service exposes Users, Role and Auth control interfaces"
Expand All @@ -36,7 +32,11 @@ ARG APP_NAME=auth-center
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
COPY --from=builder /go/src/repo/${APP_NAME}/*.txt /
COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops

# Certificates are loaded by relative paths, so run from the directory they are copied to.
WORKDIR /
# Numeric UID lets Kubernetes verify runAsNonRoot.
USER 65532:65532

EXPOSE 8000 9000
ENTRYPOINT ["/app"]
12 changes: 6 additions & 6 deletions cluster-manager/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,13 @@ COPY go.mod go.sum ./
COPY vendor/ vendor/
ENV GOCACHE=/root/.cache/go-build

RUN --mount=type=cache,target="/root/.cache/go-build" \
mkdir -p bin && \
GOBIN=/go/src/repo/bin go install github.com/google/gops

COPY --from=tools /usr/bin/task /usr/bin
COPY cluster-manager/ cluster-manager/
COPY lib/ lib/

RUN --mount=type=cache,target="/root/.cache/go-build" task -d cluster-manager build

FROM debian:12.0-slim AS runner
FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner

LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
LABEL org.opencontainers.image.description="This is a Cluster Manager service which controls child clusters from the main cluster"
Expand All @@ -35,7 +31,11 @@ ARG APP_NAME=cluster-manager

COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops

# Certificates are loaded by relative paths, so run from the directory they are copied to.
WORKDIR /
# Numeric UID lets Kubernetes verify runAsNonRoot.
USER 65532:65532

EXPOSE 8000 9000
ENTRYPOINT ["/app"]
12 changes: 6 additions & 6 deletions cs-manager/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,18 +15,14 @@ COPY go.mod go.sum ./
COPY vendor/ vendor/
ENV GOCACHE=/root/.cache/go-build

RUN --mount=type=cache,target="/root/.cache/go-build" \
mkdir -p bin && \
GOBIN=/go/src/repo/bin go install github.com/google/gops

COPY --from=tools /usr/bin/task /usr/bin
COPY cs-manager/ cs-manager/
COPY lib/ lib/
COPY cluster-manager/api/ cluster-manager/api/

RUN --mount=type=cache,target="/root/.cache/go-build" task -d cs-manager build

FROM debian:12.0-slim AS runner
FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner

LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
LABEL org.opencontainers.image.description="CS Manager is responsible for installation-wide tasks such as child cluster registration, serving /api/v1/info/* endpoints, etc"
Expand All @@ -37,7 +33,11 @@ ARG APP_NAME=cs-manager
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/unregister/unregister /unregister
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops

# Certificates are loaded by relative paths, so run from the directory they are copied to.
WORKDIR /
# Numeric UID lets Kubernetes verify runAsNonRoot.
USER 65532:65532

EXPOSE 8000 9000
ENTRYPOINT ["/app"]
12 changes: 6 additions & 6 deletions event-processor/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,6 @@ COPY go.mod go.sum ./
COPY vendor/ vendor/
ENV GOCACHE=/root/.cache/go-build

RUN --mount=type=cache,target="/root/.cache/go-build" \
mkdir -p bin && \
GOBIN=/go/src/repo/bin go install github.com/google/gops

COPY --from=tools /usr/bin/task /usr/bin
COPY event-processor/ event-processor/
COPY lib/ lib/
Expand All @@ -31,7 +27,7 @@ COPY kube-manager/api/ kube-manager/api/

RUN --mount=type=cache,target="/root/.cache/go-build" task -d event-processor build

FROM debian:12.0-slim AS runner
FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner

LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
LABEL org.opencontainers.image.description="Event processor processes events from `runtime-monitor`"
Expand All @@ -42,7 +38,11 @@ ARG APP_NAME=event-processor
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
COPY --from=builder /go/src/repo/event-processor/deploy/*.wasm /deploy/
COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops

# Certificates are loaded by relative paths, so run from the directory they are copied to.
WORKDIR /
# Numeric UID lets Kubernetes verify runAsNonRoot.
USER 65532:65532

EXPOSE 8000 9000
ENTRYPOINT ["/app"]
12 changes: 6 additions & 6 deletions history-api/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,6 @@ COPY go.mod go.sum ./
COPY vendor/ vendor/
ENV GOCACHE=/root/.cache/go-build

RUN --mount=type=cache,target="/root/.cache/go-build" \
mkdir -p bin && \
GOBIN=/go/src/repo/bin go install github.com/google/gops

COPY --from=tools /usr/bin/task /usr/bin
COPY history-api/ history-api/
COPY lib/ lib/
Expand All @@ -28,7 +24,7 @@ COPY policy-enforcer/pkg/model/ policy-enforcer/pkg/model/

RUN --mount=type=cache,target="/root/.cache/go-build" task -d history-api build

FROM debian:12.0-slim AS runner
FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner

LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
LABEL org.opencontainers.image.description="History API service saves and retrieves historic data in the system"
Expand All @@ -38,7 +34,11 @@ ARG APP_NAME=history-api

COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops

# Certificates are loaded by relative paths, so run from the directory they are copied to.
WORKDIR /
# Numeric UID lets Kubernetes verify runAsNonRoot.
USER 65532:65532

EXPOSE 8000 9000
ENTRYPOINT ["/app"]
12 changes: 6 additions & 6 deletions kube-manager/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,13 @@ COPY go.mod go.sum ./
COPY vendor/ vendor/
ENV GOCACHE=/root/.cache/go-build

RUN --mount=type=cache,target="/root/.cache/go-build" \
mkdir -p bin && \
GOBIN=/go/src/repo/bin go install github.com/google/gops

COPY --from=tools /usr/bin/task /usr/bin
COPY kube-manager/ kube-manager/
COPY lib/ lib/

RUN --mount=type=cache,target="/root/.cache/go-build" task -d kube-manager build

FROM debian:12.0-slim AS runner
FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner

LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
LABEL org.opencontainers.image.description="The Kube Manager service collects information about entities in the K8S cluster and provides interfaces for obtaining this data"
Expand All @@ -35,7 +31,11 @@ ARG APP_NAME=kube-manager

COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops

# Certificates are loaded by relative paths, so run from the directory they are copied to.
WORKDIR /
# Numeric UID lets Kubernetes verify runAsNonRoot.
USER 65532:65532

EXPOSE 8000 9000
ENTRYPOINT ["/app"]
12 changes: 6 additions & 6 deletions notifier/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,6 @@ COPY go.mod go.sum ./
COPY vendor/ vendor/
ENV GOCACHE=/root/.cache/go-build

RUN --mount=type=cache,target="/root/.cache/go-build" \
mkdir -p bin && \
GOBIN=/go/src/repo/bin go install github.com/google/gops

COPY --from=tools /usr/bin/task /usr/bin
COPY notifier/ notifier/
COPY lib/ lib/
Expand All @@ -30,7 +26,7 @@ COPY event-processor/api/ event-processor/api/

RUN --mount=type=cache,target="/root/.cache/go-build" task -d notifier build

FROM debian:12.0-slim AS runner
FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner

LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
LABEL org.opencontainers.image.description="Notifier service is responsible for sending notifications"
Expand All @@ -41,7 +37,11 @@ ARG APP_NAME=notifier
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
COPY --from=builder /go/src/repo/notifier/templates /templates
COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops

# Certificates are loaded by relative paths, so run from the directory they are copied to.
WORKDIR /
# Numeric UID lets Kubernetes verify runAsNonRoot.
USER 65532:65532

EXPOSE 8000 9000
ENTRYPOINT ["/app"]
12 changes: 6 additions & 6 deletions policy-enforcer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,13 @@ COPY go.mod go.sum ./
COPY vendor/ vendor/
ENV GOCACHE=/root/.cache/go-build

RUN --mount=type=cache,target="/root/.cache/go-build" \
mkdir -p bin && \
GOBIN=/go/src/repo/bin go install github.com/google/gops

COPY --from=tools /usr/bin/task /usr/bin
COPY policy-enforcer/ policy-enforcer/
COPY lib/ lib/

RUN --mount=type=cache,target="/root/.cache/go-build" task -d policy-enforcer build

FROM debian:12.0-slim AS runner
FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner

LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
LABEL org.opencontainers.image.description="Policy Enforcer service evaluates Policy and exposes Scope and Rule control interfaces"
Expand All @@ -35,7 +31,11 @@ ARG APP_NAME=policy-enforcer

COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops

# Certificates are loaded by relative paths, so run from the directory they are copied to.
WORKDIR /
# Numeric UID lets Kubernetes verify runAsNonRoot.
USER 65532:65532

EXPOSE 8000 9000
ENTRYPOINT ["/app"]
12 changes: 6 additions & 6 deletions public-api/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,6 @@ COPY go.mod go.sum ./
COPY vendor/ vendor/
ENV GOCACHE=/root/.cache/go-build

RUN --mount=type=cache,target="/root/.cache/go-build" \
mkdir -p bin && \
GOBIN=/go/src/repo/bin go install github.com/google/gops

COPY --from=tools /usr/bin/task /usr/bin
COPY public-api/ public-api/
COPY lib/ lib/
Expand All @@ -29,7 +25,7 @@ COPY kube-manager/ kube-manager/

RUN --mount=type=cache,target="/root/.cache/go-build" task -d public-api build

FROM debian:12.0-slim AS runner
FROM ghcr.io/runtime-radar/runtime-radar-base:20261014 AS runner

LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
LABEL org.opencontainers.image.description="REST API for using CS functionality in client services"
Expand All @@ -39,7 +35,11 @@ ARG APP_NAME=public-api

COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops

# Certificates are loaded by relative paths, so run from the directory they are copied to.
WORKDIR /
# Numeric UID lets Kubernetes verify runAsNonRoot.
USER 65532:65532

EXPOSE 8000 9000
ENTRYPOINT ["/app"]
8 changes: 2 additions & 6 deletions runtime-monitor/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,17 +17,14 @@ COPY pkg/tools/tools.go pkg/tools/

ENV GOCACHE=/root/.cache/go-build

RUN --mount=type=cache,target="/root/.cache/go-build" \
mkdir -p bin && \
GOBIN=/go/src/repo/bin go install github.com/google/gops

COPY --from=tools /usr/bin/task /usr/bin
COPY runtime-monitor/ runtime-monitor/
COPY lib/ lib/

RUN --mount=type=cache,target="/root/.cache/go-build" task -d runtime-monitor build

FROM debian:12.0-slim AS runner
# Runs as root: runtime-monitor talks to Tetragon, which runs as root in the same pod.
FROM gcr.io/distroless/static-debian13 AS runner

LABEL org.opencontainers.image.source=https://github.com/runtime-radar/runtime-radar
LABEL org.opencontainers.image.description="Runtime monitor monitors runtime events in k8s"
Expand All @@ -37,7 +34,6 @@ ARG APP_NAME=runtime-monitor

COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/${APP_NAME} /app
COPY --from=builder /go/src/repo/${APP_NAME}/cmd/${APP_NAME}/*.pem /
COPY --from=builder /go/src/repo/bin/gops /usr/bin/gops

EXPOSE 8000 9000
ENTRYPOINT ["/app"]
Loading