feat: Ensure non-root container images. #382
Conversation
pantierra
force-pushed
the
feature/non-root-images
branch
4 times, most recently
from
d50030b to
cee859a
Compare
|
Check work. Now we have to wait and rebase until all upstream projects release the non-root container images. |
pantierra
force-pushed
the
feature/non-root-images
branch
from
cee859a to
517d8c0
Compare
pantierra
force-pushed
the
feature/non-root-images
branch
from
517d8c0 to
7023284
Compare
|
STAC Browser 4.0.0 includes the change: https://github.com/radiantearth/stac-browser/releases/tag/v4.0.0 |
|
Yes, STAC-Browser 4.0.0 is part of #376 |
pantierra
force-pushed
the
feature/non-root-images
branch
2 times, most recently
from
aa9314e to
3b4e0e0
Compare
| initContainers: | ||
| - name: wait-for-pgstac-jobs | ||
| image: alpine/k8s:1.28.0 | ||
| image: bitnami/kubectl:latest |
There was a problem hiding this comment.
Can we use this one? Should it not be bitnamilegacy/kubectl:<something>?
Either way, I'd say ⛔ to bitnami.
There was a problem hiding this comment.
It works. Even without the legacy part.
As far as i know this is the only (serious) one that runs as non-root. Maybe we should stick to alpine/k8s but use securityContext with it?!
There was a problem hiding this comment.
Weird. I'm not convinced when deployed, it will work, but not sure, maybe kubectl is a rare case of bitnami truly keeping it free..
|
All services are running now as non-root, but |
pantierra
force-pushed
the
feature/non-root-images
branch
2 times, most recently
from
447d2dd to
3b4e0e0
Compare
pantierra
force-pushed
the
main
branch
7 times, most recently
from
6f0a6fe to
25dc65d
Compare
pantierra
force-pushed
the
feature/non-root-images
branch
from
3b4e0e0 to
a8abf21
Compare
pantierra
force-pushed
the
feature/non-root-images
branch
from
a8abf21 to
e211b95
Compare
Closes EOEPCA/resource-discovery#163