craigcondit commented on code in PR #564:
URL: https://github.com/apache/yunikorn-k8shim/pull/564#discussion_r1152544895
##########
deployments/image/admission/Dockerfile:
##########
@@ -14,22 +14,7 @@
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
-
-ARG ARCH=
-FROM ${ARCH}alpine:latest
-
-# Home location for all data and configs
-ENV HOME=/opt/yunikorn
-
-# Always run everything as yunikorn
-RUN mkdir -p $HOME && \
- addgroup -S -g 4444 yunikorn && \
- adduser -S -h $HOME -G yunikorn -u 4444 yunikorn -s /bin/sh && \
- chown -R 4444:0 $HOME && \
- chmod -R g=u $HOME
-
-COPY --chown=4444:0 scheduler-admission-controller $HOME/bin/
-
-WORKDIR $HOME
-USER yunikorn
-ENTRYPOINT $HOME/bin/scheduler-admission-controller
+FROM scratch
+COPY --chown=0:0 scheduler-admission-controller /
+USER 4444:4444
+ENTRYPOINT [ "/scheduler-admission-controller" ]
Review Comment:
Implementation details: We use `COPY --chown=0:0` to ensure that the
installed binaries are owned by root (as we should not have write access to
them). `USER 4444:4444` is used to ensure we run (by default at least) as a
non-privileged user. Finally, the entrypoint is given in long form so that no
shell is needed in the container. The resulting container image will contain
*only* the resources listed in the `COPY`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
