From 045189c522b8b9fb407949724e0573ae5b7628c6 Mon Sep 17 00:00:00 2001 From: Arvind Thirumurugan Date: Fri, 8 Aug 2025 12:10:17 -0700 Subject: [PATCH 1/4] use base distroless images from MCR --- docker/crd-installer.Dockerfile | 9 +++++---- docker/hub-agent.Dockerfile | 10 +++++----- docker/member-agent.Dockerfile | 10 +++++----- docker/refresh-token.Dockerfile | 10 +++++----- 4 files changed, 20 insertions(+), 19 deletions(-) diff --git a/docker/crd-installer.Dockerfile b/docker/crd-installer.Dockerfile index ecd69b78d..d7b8084bc 100644 --- a/docker/crd-installer.Dockerfile +++ b/docker/crd-installer.Dockerfile @@ -14,11 +14,12 @@ COPY cmd/crdinstaller/ cmd/crdinstaller/ ARG TARGETARCH -# Build -RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -o crdinstaller cmd/crdinstaller/main.go +# Build with CGO enabled and GOEXPERIMENT=system for internal usage +RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=system GO111MODULE=on go build -o crdinstaller cmd/crdinstaller/main.go -# Use distroless as minimal base image to package the crdinstaller binary -FROM gcr.io/distroless/static:nonroot +# Use Azure Linux distroless as minimal base image to package the crdinstaller binary +# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details +FROM mcr.microsoft.com/azurelinux/distroless/minimal:3.0 WORKDIR / COPY --from=builder /workspace/crdinstaller . COPY config/crd/bases/ /workspace/config/crd/bases/ diff --git a/docker/hub-agent.Dockerfile b/docker/hub-agent.Dockerfile index d674ce51f..44a3dba5d 100644 --- a/docker/hub-agent.Dockerfile +++ b/docker/hub-agent.Dockerfile @@ -16,12 +16,12 @@ COPY pkg/ pkg/ ARG TARGETARCH -# Build -RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -o hubagent cmd/hubagent/main.go +# Build with CGO enabled and GOEXPERIMENT=system for internal usage +RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=system GO111MODULE=on go build -o hubagent cmd/hubagent/main.go -# Use distroless as minimal base image to package the hubagent binary -# Refer to https://github.com/GoogleContainerTools/distroless for more details -FROM gcr.io/distroless/static:nonroot +# Use Azure Linux distroless as minimal base image to package the hubagent binary +# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details +FROM mcr.microsoft.com/azurelinux/distroless/minimal:3.0 WORKDIR / COPY --from=builder /workspace/hubagent . USER 65532:65532 diff --git a/docker/member-agent.Dockerfile b/docker/member-agent.Dockerfile index 2b35ad2a8..bec9381ff 100644 --- a/docker/member-agent.Dockerfile +++ b/docker/member-agent.Dockerfile @@ -16,12 +16,12 @@ COPY pkg/ pkg/ ARG TARGETARCH -# Build -RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -o memberagent main.go +# Build with CGO enabled and GOEXPERIMENT=system for internal usage +RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=system GO111MODULE=on go build -o memberagent main.go -# Use distroless as minimal base image to package the memberagent binary -# Refer to https://github.com/GoogleContainerTools/distroless for more details -FROM gcr.io/distroless/static:nonroot +# Use Azure Linux distroless as minimal base image to package the memberagent binary +# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details +FROM mcr.microsoft.com/azurelinux/distroless/minimal:3.0 WORKDIR / COPY --from=builder /workspace/memberagent . USER 65532:65532 diff --git a/docker/refresh-token.Dockerfile b/docker/refresh-token.Dockerfile index 2f7e764c8..205367615 100644 --- a/docker/refresh-token.Dockerfile +++ b/docker/refresh-token.Dockerfile @@ -15,12 +15,12 @@ COPY pkg/authtoken pkg/authtoken ARG TARGETARCH -# Build -RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -o refreshtoken main.go +# Build with CGO enabled and GOEXPERIMENT=system for internal usage +RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=system GO111MODULE=on go build -o refreshtoken main.go -# Use distroless as minimal base image to package the refreshtoken binary -# Refer to https://github.com/GoogleContainerTools/distroless for more details -FROM gcr.io/distroless/static:nonroot +# Use Azure Linux distroless as minimal base image to package the refreshtoken binary +# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details +FROM mcr.microsoft.com/azurelinux/distroless/minimal:3.0 WORKDIR / COPY --from=builder /workspace/refreshtoken . USER 65532:65532 From 03bb115d0de2f8d0c261956c92254e9b6b8a1b8c Mon Sep 17 00:00:00 2001 From: Arvind Thirumurugan Date: Fri, 8 Aug 2025 12:19:33 -0700 Subject: [PATCH 2/4] system->systemcrypto --- docker/crd-installer.Dockerfile | 4 ++-- docker/hub-agent.Dockerfile | 4 ++-- docker/member-agent.Dockerfile | 4 ++-- docker/refresh-token.Dockerfile | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docker/crd-installer.Dockerfile b/docker/crd-installer.Dockerfile index d7b8084bc..f58917e70 100644 --- a/docker/crd-installer.Dockerfile +++ b/docker/crd-installer.Dockerfile @@ -14,8 +14,8 @@ COPY cmd/crdinstaller/ cmd/crdinstaller/ ARG TARGETARCH -# Build with CGO enabled and GOEXPERIMENT=system for internal usage -RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=system GO111MODULE=on go build -o crdinstaller cmd/crdinstaller/main.go +# Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage +RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o crdinstaller cmd/crdinstaller/main.go # Use Azure Linux distroless as minimal base image to package the crdinstaller binary # Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details diff --git a/docker/hub-agent.Dockerfile b/docker/hub-agent.Dockerfile index 44a3dba5d..9748e0658 100644 --- a/docker/hub-agent.Dockerfile +++ b/docker/hub-agent.Dockerfile @@ -16,8 +16,8 @@ COPY pkg/ pkg/ ARG TARGETARCH -# Build with CGO enabled and GOEXPERIMENT=system for internal usage -RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=system GO111MODULE=on go build -o hubagent cmd/hubagent/main.go +# Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage +RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o hubagent cmd/hubagent/main.go # Use Azure Linux distroless as minimal base image to package the hubagent binary # Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details diff --git a/docker/member-agent.Dockerfile b/docker/member-agent.Dockerfile index bec9381ff..3044365ad 100644 --- a/docker/member-agent.Dockerfile +++ b/docker/member-agent.Dockerfile @@ -16,8 +16,8 @@ COPY pkg/ pkg/ ARG TARGETARCH -# Build with CGO enabled and GOEXPERIMENT=system for internal usage -RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=system GO111MODULE=on go build -o memberagent main.go +# Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage +RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o memberagent main.go # Use Azure Linux distroless as minimal base image to package the memberagent binary # Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details diff --git a/docker/refresh-token.Dockerfile b/docker/refresh-token.Dockerfile index 205367615..5f204a19b 100644 --- a/docker/refresh-token.Dockerfile +++ b/docker/refresh-token.Dockerfile @@ -15,8 +15,8 @@ COPY pkg/authtoken pkg/authtoken ARG TARGETARCH -# Build with CGO enabled and GOEXPERIMENT=system for internal usage -RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=system GO111MODULE=on go build -o refreshtoken main.go +# Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage +RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o refreshtoken main.go # Use Azure Linux distroless as minimal base image to package the refreshtoken binary # Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details From a60fc0bd16f00de91053a28267979c50549540fc Mon Sep 17 00:00:00 2001 From: Arvind Thirumurugan Date: Fri, 8 Aug 2025 14:17:42 -0700 Subject: [PATCH 3/4] use base image --- docker/crd-installer.Dockerfile | 6 +++--- docker/hub-agent.Dockerfile | 6 +++--- docker/member-agent.Dockerfile | 6 +++--- docker/refresh-token.Dockerfile | 8 ++++---- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/docker/crd-installer.Dockerfile b/docker/crd-installer.Dockerfile index f58917e70..cec802017 100644 --- a/docker/crd-installer.Dockerfile +++ b/docker/crd-installer.Dockerfile @@ -17,9 +17,9 @@ ARG TARGETARCH # Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o crdinstaller cmd/crdinstaller/main.go -# Use Azure Linux distroless as minimal base image to package the crdinstaller binary -# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details -FROM mcr.microsoft.com/azurelinux/distroless/minimal:3.0 +# Use Azure Linux distroless base instead of minimal to package the crdinstaller binary +# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/base/about for more details +FROM mcr.microsoft.com/azurelinux/distroless/base:3.0 WORKDIR / COPY --from=builder /workspace/crdinstaller . COPY config/crd/bases/ /workspace/config/crd/bases/ diff --git a/docker/hub-agent.Dockerfile b/docker/hub-agent.Dockerfile index 9748e0658..dae29fb55 100644 --- a/docker/hub-agent.Dockerfile +++ b/docker/hub-agent.Dockerfile @@ -19,9 +19,9 @@ ARG TARGETARCH # Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o hubagent cmd/hubagent/main.go -# Use Azure Linux distroless as minimal base image to package the hubagent binary -# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details -FROM mcr.microsoft.com/azurelinux/distroless/minimal:3.0 +# Use Azure Linux distroless base instead of minimal to package the hubagent binary +# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/base/about for more details +FROM mcr.microsoft.com/azurelinux/distroless/base:3.0 WORKDIR / COPY --from=builder /workspace/hubagent . USER 65532:65532 diff --git a/docker/member-agent.Dockerfile b/docker/member-agent.Dockerfile index 3044365ad..45f03e3d3 100644 --- a/docker/member-agent.Dockerfile +++ b/docker/member-agent.Dockerfile @@ -19,9 +19,9 @@ ARG TARGETARCH # Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o memberagent main.go -# Use Azure Linux distroless as minimal base image to package the memberagent binary -# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details -FROM mcr.microsoft.com/azurelinux/distroless/minimal:3.0 +# Use Azure Linux distroless base instead of minimal to package the memberagent binary +# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/base/about for more details +FROM mcr.microsoft.com/azurelinux/distroless/base:3.0 WORKDIR / COPY --from=builder /workspace/memberagent . USER 65532:65532 diff --git a/docker/refresh-token.Dockerfile b/docker/refresh-token.Dockerfile index 5f204a19b..fef08882c 100644 --- a/docker/refresh-token.Dockerfile +++ b/docker/refresh-token.Dockerfile @@ -1,4 +1,4 @@ -# Build the hubagent binary +# Build the refreshtoken binary FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.4 AS builder WORKDIR /workspace @@ -18,9 +18,9 @@ ARG TARGETARCH # Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o refreshtoken main.go -# Use Azure Linux distroless as minimal base image to package the refreshtoken binary -# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/minimal/about for more details -FROM mcr.microsoft.com/azurelinux/distroless/minimal:3.0 +# Use Azure Linux distroless base instead of minimal to package the refreshtoken binary +# Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/base/about for more details +FROM mcr.microsoft.com/azurelinux/distroless/base:3.0 WORKDIR / COPY --from=builder /workspace/refreshtoken . USER 65532:65532 From 635d37da3ed40952762bcad6e2ec052cb5d8049a Mon Sep 17 00:00:00 2001 From: Arvind Thirumurugan Date: Mon, 11 Aug 2025 11:30:01 -0700 Subject: [PATCH 4/4] fix comments --- docker/crd-installer.Dockerfile | 2 +- docker/hub-agent.Dockerfile | 2 +- docker/member-agent.Dockerfile | 2 +- docker/refresh-token.Dockerfile | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docker/crd-installer.Dockerfile b/docker/crd-installer.Dockerfile index cec802017..8485663e3 100644 --- a/docker/crd-installer.Dockerfile +++ b/docker/crd-installer.Dockerfile @@ -17,7 +17,7 @@ ARG TARGETARCH # Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o crdinstaller cmd/crdinstaller/main.go -# Use Azure Linux distroless base instead of minimal to package the crdinstaller binary +# Use Azure Linux distroless base image to package the crdinstaller binary # Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/base/about for more details FROM mcr.microsoft.com/azurelinux/distroless/base:3.0 WORKDIR / diff --git a/docker/hub-agent.Dockerfile b/docker/hub-agent.Dockerfile index dae29fb55..48eb7b3e4 100644 --- a/docker/hub-agent.Dockerfile +++ b/docker/hub-agent.Dockerfile @@ -19,7 +19,7 @@ ARG TARGETARCH # Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o hubagent cmd/hubagent/main.go -# Use Azure Linux distroless base instead of minimal to package the hubagent binary +# Use Azure Linux distroless base image to package the hubagent binary # Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/base/about for more details FROM mcr.microsoft.com/azurelinux/distroless/base:3.0 WORKDIR / diff --git a/docker/member-agent.Dockerfile b/docker/member-agent.Dockerfile index 45f03e3d3..4761ac3af 100644 --- a/docker/member-agent.Dockerfile +++ b/docker/member-agent.Dockerfile @@ -19,7 +19,7 @@ ARG TARGETARCH # Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o memberagent main.go -# Use Azure Linux distroless base instead of minimal to package the memberagent binary +# Use Azure Linux distroless base image to package the memberagent binary # Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/base/about for more details FROM mcr.microsoft.com/azurelinux/distroless/base:3.0 WORKDIR / diff --git a/docker/refresh-token.Dockerfile b/docker/refresh-token.Dockerfile index fef08882c..1b59d1ca8 100644 --- a/docker/refresh-token.Dockerfile +++ b/docker/refresh-token.Dockerfile @@ -18,7 +18,7 @@ ARG TARGETARCH # Build with CGO enabled and GOEXPERIMENT=systemcrypto for internal usage RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} GOEXPERIMENT=systemcrypto GO111MODULE=on go build -o refreshtoken main.go -# Use Azure Linux distroless base instead of minimal to package the refreshtoken binary +# Use Azure Linux distroless base image to package the refreshtoken binary # Refer to https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/distroless/base/about for more details FROM mcr.microsoft.com/azurelinux/distroless/base:3.0 WORKDIR /