Fix serving samples to run as non-root #5794

prushh · 2023-12-11T21:52:46Z

Proposed Changes

Changes discussed on #5758

Overview

cloudevents-dotnet -- OK
cloudevents-go -- OK
cloudevents-nodejs -- OK
cloud events-rust -- Need help, build error on L18 (I wasn't able to create the build locally and I tried to do that using multi-stage container)

RUN rustup target add x86_64-unknown-linux-musl && cargo build --target x86_64-unknown-linux-musl --release:
0.370    info: downloading component 'rust-std' for 'x86_64-unknown-linux-musl'
5.900    info: installing component 'rust-std' for 'x86_64-unknown-linux-musl'
7.002    error: failed to parse lock file at: /Cargo.lock
7.002    Caused by:
7.002    invalid serialized PackageId for key `package.dependencies`

Additional info

Wherever possible, projects were tested with Docker as follows:

docker buildx build --platform linux/amd64 -t <image> .
docker run -p 8080:8080 <image>

curl -X POST \
  -H "content-type: application/json"  \
  -H "ce-specversion: 1.0"  \
  -H "ce-source: curl-command"  \
  -H "ce-type: curl.demo"  \
  -H "ce-id: 123-abc"  \
  -d '{"name":"Dave"}' \
  localhost:8080
# OR
curl localhost:8080

Can you please take a look @ReToCode @kauana?

Update README.md file when necessary

netlify · 2023-12-11T21:52:58Z

✅ Deploy Preview for knative ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`fc606a0`
🔍 Latest deploy log	https://app.netlify.com/sites/knative/deploys/6630a0cfd5383a00080e67d8
😎 Deploy Preview	https://deploy-preview-5794--knative.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

knative-prow · 2023-12-11T21:53:16Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: prushh
Once this PR has been reviewed and has the lgtm label, please assign pierdipi for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Necessary to pass TestDocSrc

ReToCode

Thanks for doing this @prushh. Seems like lot of images are pretty outdated.
I commented inline, hope that helps with the build errors.

ReToCode · 2023-12-12T08:36:07Z

code-samples/serving/cloudevents/cloudevents-nodejs/Dockerfile

@@ -12,27 +12,42 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-FROM registry.access.redhat.com/ubi8/nodejs-12
+FROM node:20-alpine as builder


@matzew ok with this change?

ReToCode · 2023-12-12T08:38:03Z

code-samples/serving/cloudevents/cloudevents-rust/Dockerfile

@@ -11,10 +11,29 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+FROM rust:1.31.0 AS builder


probably worth to take a look at #5757 as well.

Sorry for the late reply!
I'm following the PR above as you suggested and the build was successful, but I get an image size of 2.32GB. I also tried to run and curl it but I got curl: (56) Recv failure: Connection reset by peer error.

FROM rust:1.73.0 AS builder ARG USER=appuser ARG USER_UID=1001 ARG USER_GID=$USER_UID # Add a user so the server will run as a non-root user. RUN addgroup --gid $USER_GID $USER && \ adduser -u $USER_UID --ingroup $USER --disabled-password $USER COPY . . RUN cargo install --path . USER $USER CMD ["knative-cloudevents-example"]

Now as a first step I'm trying to reduce the image size by using a second stage where I copy and execute the release.

code-samples/serving/gitwebhook-go/Dockerfile

code-samples/serving/multi-container/servingcontainer/Dockerfile

code-samples/serving/multi-container/sidecarcontainer/Dockerfile

code-samples/serving/secrets-go/Dockerfile

code-samples/serving/hello-world/helloworld-shell/Dockerfile

Update dockerfiles on docs

prushh · 2023-12-15T11:46:20Z

@ReToCode I will work on the missing fixes as soon as possible 😄

ReToCode · 2024-02-20T06:31:37Z

Hey @prushh, are you still working on the last fixes?

prushh · 2024-02-20T07:39:27Z

Hey @ReToCode!
Unfortunately not, I am currently busy with university... I don't think I'll be able to work on it before mid-March 😪

ReToCode · 2024-02-20T12:21:25Z

Ok thanks, no worries, there is no rush on it.

ReToCode · 2024-04-15T12:14:13Z

@prushh how are things? Are you still willing to work on this PR?

prushh · 2024-04-19T06:53:48Z

Hi @ReToCode, sorry for the late reply.
I tried many times to build a multi-stage image for cloudevents-rust project, but without success. I found some examples on the net but unfortunately they didn't work. Could we merge this PR and open a new issue for cloudevents-rust and helloworld-shell projects?

ReToCode · 2024-04-19T11:26:36Z

Yes that is fine, could you please rebase and create the issue with what you found so far?

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0. - [Commits](golang/crypto@v0.14.0...v0.17.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

bumping knative.dev/hack eb35242...7030d5b: > 7030d5b Update community files (# 355) > 94f0ccf Update community files (# 354) Signed-off-by: Knative Automation <[email protected]>

Signed-off-by: Abhay <[email protected]>

* improve grafana configuration steps * update metrics documentation * fix prometheus svc name * fix section titles Describe kube-prometheus-stack and components * fix prometheus stack sections order * fix grafana sections order and level

* Resolved the bug in the default styling of note Signed-off-by: Abhay <[email protected]> * resolved spaces Signed-off-by: Abhay <[email protected]> * Resolved Link-Not-Opening Signed-off-by: Abhay <[email protected]> --------- Signed-off-by: Abhay <[email protected]>

Signed-off-by: Knative Automation <[email protected]>

bumping knative.dev/hack 7030d5b...3ea694d: > 3ea694d include additional k8s bash file when updating exec permission (# 357) > 2f27d6e Update community files (# 356) Signed-off-by: Knative Automation <[email protected]>

bumping knative.dev/hack b9f6bf0...7e71024: > 7e71024 Add clotributor link to readme (# 353) > b1b2956 Add consistent SECURITY.md (# 349) > 4f7621a Call go mod download on each module, if not vendor (# 326) > 424e75e Update community files (# 374) Signed-off-by: Knative Automation <[email protected]>

…native#5927) Bumps [express](https://github.com/expressjs/express) from 4.17.3 to 4.19.2. - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.17.3...4.19.2) --- updated-dependencies: - dependency-name: express dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…native#5926) Bumps [express](https://github.com/expressjs/express) from 4.18.2 to 4.19.2. - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.18.2...4.19.2) --- updated-dependencies: - dependency-name: express dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* upgrade to latest dependencies bumping knative.dev/hack 7e71024...47368d6: > 47368d6 Check licenses only, but not bundle them (# 376) > b985a5b Update community files (# 377) Signed-off-by: Knative Automation <[email protected]> * Fix unit-tests --------- Signed-off-by: Knative Automation <[email protected]> Co-authored-by: Reto Lehmann <[email protected]>

* Knative Backstage plugin article Signed-off-by: Ali Ok <[email protected]> * Add some images Signed-off-by: Ali Ok <[email protected]> * Make YouTube video image larger Signed-off-by: Ali Ok <[email protected]> * Show embedded YouTube video Signed-off-by: Ali Ok <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md Co-authored-by: Christoph Stäbler <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md Co-authored-by: Christoph Stäbler <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md Co-authored-by: Christoph Stäbler <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md Co-authored-by: Leo Li <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md Co-authored-by: Leo Li <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md Co-authored-by: Leo Li <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md Co-authored-by: Leo Li <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md Co-authored-by: Leo Li <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md Co-authored-by: Leo Li <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md Co-authored-by: Leo Li <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md Co-authored-by: Leo Li <[email protected]> * Address comments, add target=_blank to links Signed-off-by: Ali Ok <[email protected]> * Update blog/docs/articles/knative-backstage-plugins.md * Update blog/docs/articles/knative-backstage-plugins.md * Update blog/docs/articles/knative-backstage-plugins.md * Update blog/docs/articles/knative-backstage-plugins.md * Update blog/docs/articles/knative-backstage-plugins.md --------- Signed-off-by: Ali Ok <[email protected]> Co-authored-by: Christoph Stäbler <[email protected]> Co-authored-by: Leo Li <[email protected]>

Signed-off-by: Knative Automation <[email protected]>

ConfigMap values can only be of type String

* Add documentation for probing * Use white diagram background * Add more details about probing * Review improvements

* Add darkmode * Edit README * Add comments and readme * Fix UI * Update README * Update code-samples/eventing/bookstore-sample-app/frontend/client/pages/Main.js Co-authored-by: Leo Li <[email protected]> * Update code-samples/eventing/bookstore-sample-app/frontend/client/components/BookDetail.js Co-authored-by: Leo Li <[email protected]> * Change emoji * Update code-samples/eventing/bookstore-sample-app/frontend/client/components/Toggle.js Co-authored-by: Leo Li <[email protected]> * Fix UI * Align time --------- Co-authored-by: Leo Li <[email protected]>

Signed-off-by: tico88612 <[email protected]>

* Adding the db service * Add the readme * Add the yaml file to create the config map * Change to use the statefulSet * Delete the finished job pod after 50 seconds * Simplify the deployment tutorial for the database service * Explain why we don't use Knative Service * Remove the unnessary empty lines in the file * Update code-samples/eventing/bookstore-sample-app/db/README.md Co-authored-by: Pierangelo Di Pilato <[email protected]> * Update code-samples/eventing/bookstore-sample-app/db-service/sample.sql Co-authored-by: Pierangelo Di Pilato <[email protected]> * Update code-samples/eventing/bookstore-sample-app/db/README.md Co-authored-by: Pierangelo Di Pilato <[email protected]> * Fix the review comment --------- Co-authored-by: Pierangelo Di Pilato <[email protected]>

Signed-off-by: Zuhair AlSader <[email protected]>

* Add limitations for having OIDC and Istio enabled * Fix list

) Bumps [h2](https://github.com/hyperium/h2) from 0.3.24 to 0.3.26. - [Release notes](https://github.com/hyperium/h2/releases) - [Changelog](https://github.com/hyperium/h2/blob/v0.3.26/CHANGELOG.md) - [Commits](hyperium/h2@v0.3.24...v0.3.26) --- updated-dependencies: - dependency-name: h2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Knative Automation <[email protected]>

bumping knative.dev/hack 47368d6...1133b37: > 1133b37 Update community files (# 378) Signed-off-by: Knative Automation <[email protected]>

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.17.0 to 0.23.0. - [Commits](golang/net@v0.17.0...v0.23.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Add list with OIDC authn supporting eventing components * Fix indent * Remove links to GH pages for channels

Signed-off-by: Knative Automation <[email protected]>

* Add the node.js server * Setting up the infrastructure * Update the port of the node application * Add the sinkBinding * Adding the reply feedback loop * Adding the response into the nodejs server * Change the naming convention * Update the index.js to remove the uncessary comments

…sis service (knative#5904) * Adding the knative function build for the sentiment analysis service * Update the sample code, so that the returned result is a cloudEvent * Update the sample code to give a specific event type to the response cloudEvent * Update the tutorial doc * Update the tutorial doc * Remove the docker registry info * Fix nit * Modify the return response type and how python function handle the incoming cloudEvent * Adding the explaination for serving * Unhide the alert box portion * Remove the intentional delay * Remove the duplicated line * Make the input as json instead of plaintext * Update the version of cloudEvent and update the deployment instruction * Update the tutorial to use the public URL instead of cluster-IP * Display the input text in the response

…ode (knative#5947) * Fix the content in the bad word filter knative function code * Remove the unused import * fix: fix the python format by running black

Signed-off-by: Knative Automation <[email protected]>

…k workspace (knative#5939) * add tutorial * create workspace docs * Edit img

Signed-off-by: Matthias Wessendorf <[email protected]>

* document the remaining timeout settings * fix name

prushh · 2024-04-30T07:28:47Z

Hi @ReToCode! It was my first rebase, I hope I've done everything correctly.
In the afternoon I should be able to create the issue.

prushh added 3 commits December 11, 2023 22:11

fix some hello-world samples' Dockerfile to run as non-root user

b0caa0f

Update README.md file when necessary

fix some cloudevents samples' Dockerfile to run as non-root user

1607062

Update README.md file when necessary

fix other serving samples' Dockerfile to run as non-root user

92854d1

Update README.md file when necessary

knative-prow bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Dec 11, 2023

knative-prow bot requested review from skonto and snneji December 11, 2023 21:53

Update README.md

1086fda

Necessary to pass TestDocSrc

ReToCode reviewed Dec 12, 2023

View reviewed changes

code-samples/serving/hello-world/helloworld-shell/Dockerfile Show resolved Hide resolved

prushh added 2 commits December 15, 2023 12:41

bump go to 1.21 on multi-container

c95f68e

Update README.md

198ae74

Update dockerfiles on docs

fix gitwebook and secrets build errors

cd1ba30

knative-prow-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 28, 2024

dependabot bot and others added 8 commits April 30, 2024 09:17

upgrade to latest dependencies (knative#5797)

e0867e5

bumping knative.dev/hack eb35242...7030d5b: > 7030d5b Update community files (# 355) > 94f0ccf Update community files (# 354) Signed-off-by: Knative Automation <[email protected]>

Enable copy for code blocks (knative#5806)

66d6e52

Updated Copywrite Information (knative#5807)

c12da92

Signed-off-by: Abhay <[email protected]>

Update community files (knative#5814)

55ca452

Signed-off-by: Knative Automation <[email protected]>

upgrade to latest dependencies (knative#5816)

3775e98

bumping knative.dev/hack 7030d5b...3ea694d: > 3ea694d include additional k8s bash file when updating exec permission (# 357) > 2f27d6e Update community files (# 356) Signed-off-by: Knative Automation <[email protected]>

knative-automation and others added 27 commits April 30, 2024 09:17

Update community files (knative#5934)

844c99d

Signed-off-by: Knative Automation <[email protected]>

Update enabling-automatic-tls-certificate-provisioning.md (knative#5933)

188d81e

ConfigMap values can only be of type String

Add documentation for Serving probes (knative#5855)

0150bc7

* Add documentation for probing * Use white diagram background * Add more details about probing * Review improvements

fix correct display (knative#5937)

81936c1

Feat: Inappropriate language filter python script (knative#5935)

30ced8d

Signed-off-by: tico88612 <[email protected]>

Add Ceph Source to Event Sources (knative#5895)

9a7eff0

Signed-off-by: Zuhair AlSader <[email protected]>

Add limitations for having OIDC and Istio enabled (knative#5940)

6df0587

* Add limitations for having OIDC and Istio enabled * Fix list

Update community files (knative#5944)

4e69af4

Signed-off-by: Knative Automation <[email protected]>

upgrade to latest dependencies (knative#5942)

b346d2c

bumping knative.dev/hack 47368d6...1133b37: > 1133b37 Update community files (# 378) Signed-off-by: Knative Automation <[email protected]>

Add list with OIDC authn supporting eventing components (knative#5941)

35e4433

* Add list with OIDC authn supporting eventing components * Fix indent * Remove links to GH pages for channels

upgrade to latest dependencies (knative#5946)

6766f84

Signed-off-by: Knative Automation <[email protected]>

Sample App: Fix the content in the bad word filter knative function c…

f389865

…ode (knative#5947) * Fix the content in the bad word filter knative function code * Remove the unused import * fix: fix the python format by running black

Update community files (knative#5951)

5698ba7

Signed-off-by: Knative Automation <[email protected]>

Notification service docs: Add the tutorial on how to create the slac…

0495f68

…k workspace (knative#5939) * add tutorial * create workspace docs * Edit img

Adding Kafka Source details on delivery spec (knative#5952)

a9056f0

Signed-off-by: Matthias Wessendorf <[email protected]>

Document the remaining timeout settings (knative#5954)

ac49fbc

* document the remaining timeout settings * fix name

Merge branch 'main' into fix-sample-images-non-root

fc606a0

knative-prow-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 30, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix serving samples to run as non-root #5794

Fix serving samples to run as non-root #5794

prushh commented Dec 11, 2023 •

edited

netlify bot commented Dec 11, 2023 •

edited

knative-prow bot commented Dec 11, 2023

ReToCode left a comment

ReToCode Dec 12, 2023

ReToCode Dec 12, 2023

prushh Jan 9, 2024 •

edited

prushh commented Dec 15, 2023

ReToCode commented Feb 20, 2024

prushh commented Feb 20, 2024 •

edited

ReToCode commented Feb 20, 2024

ReToCode commented Apr 15, 2024

prushh commented Apr 19, 2024 •

edited

ReToCode commented Apr 19, 2024

prushh commented Apr 30, 2024

Fix serving samples to run as non-root #5794

Are you sure you want to change the base?

Fix serving samples to run as non-root #5794

Conversation

prushh commented Dec 11, 2023 • edited

Proposed Changes

Overview

Additional info

netlify bot commented Dec 11, 2023 • edited

✅ Deploy Preview for knative ready!

knative-prow bot commented Dec 11, 2023

ReToCode left a comment

Choose a reason for hiding this comment

ReToCode Dec 12, 2023

Choose a reason for hiding this comment

ReToCode Dec 12, 2023

Choose a reason for hiding this comment

prushh Jan 9, 2024 • edited

Choose a reason for hiding this comment

prushh commented Dec 15, 2023

ReToCode commented Feb 20, 2024

prushh commented Feb 20, 2024 • edited

ReToCode commented Feb 20, 2024

ReToCode commented Apr 15, 2024

prushh commented Apr 19, 2024 • edited

ReToCode commented Apr 19, 2024

prushh commented Apr 30, 2024

prushh commented Dec 11, 2023 •

edited

netlify bot commented Dec 11, 2023 •

edited

prushh Jan 9, 2024 •

edited

prushh commented Feb 20, 2024 •

edited

prushh commented Apr 19, 2024 •

edited