Copilot commented on code in PR #6284:
URL: https://github.com/apache/ignite-3/pull/6284#discussion_r2218627835
##########
packaging/docker/Dockerfile:
##########
@@ -11,10 +11,19 @@ RUN $JAVA_HOME/bin/jlink \
# Same base image as eclipse-temurin
FROM ubuntu:22.04
+ARG DOTNET_VERSION=8.0
+ARG DOTNET_PACKAGE_NAME=dotnet-runtime
+
ENV JAVA_HOME=/opt/java/openjdk
ENV PATH="${JAVA_HOME}/bin:${PATH}"
COPY --from=jre-build /javaruntime $JAVA_HOME
+# Install .NET Runtime
+RUN apt-get update && \
Review Comment:
[nitpick] Missing apt-get update cache invalidation. Consider adding
`--no-cache` or ensure the package list is current by running apt-get update in
the same RUN instruction, which is already being done correctly here.
##########
packaging/docker/Dockerfile:
##########
@@ -11,10 +11,19 @@ RUN $JAVA_HOME/bin/jlink \
# Same base image as eclipse-temurin
FROM ubuntu:22.04
+ARG DOTNET_VERSION=8.0
+ARG DOTNET_PACKAGE_NAME=dotnet-runtime
+
ENV JAVA_HOME=/opt/java/openjdk
ENV PATH="${JAVA_HOME}/bin:${PATH}"
COPY --from=jre-build /javaruntime $JAVA_HOME
+# Install .NET Runtime
+RUN apt-get update && \
+ apt-get install -y --no-install-recommends
${DOTNET_PACKAGE_NAME}-${DOTNET_VERSION} && \
Review Comment:
The package installation uses variables without proper validation. Consider
adding wget/curl and installing from Microsoft's official repository with GPG
verification instead of relying on Ubuntu's package manager for .NET runtime to
ensure package authenticity and security.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscr...@ignite.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
