Harden container images: distroless non-root with SecurityContext - #2
Merged
Conversation
minivolk
force-pushed
the
feature/distroless-hardening
branch
2 times, most recently
from
March 29, 2026 21:19
54d12aa to
9c99e40
Compare
Security hardening for all injected containers: Dockerfile (envproxy image): - Use gcr.io/distroless/cc-debian12:nonroot (was cc-debian12 without tag) - Add USER nonroot:nonroot Dockerfile (injector image): - Already using gcr.io/distroless/static:nonroot (no change) Webhook mutator: - Add SecurityContext to both init container and sidecar: runAsNonRoot: true, readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, capabilities.drop: ["ALL"] Build context: - Add .dockerignore to exclude .git, target/, node_modules/, __pycache__/, IDE files from Docker build context
…Fix non-root user: use numeric UID 65534 for Kubernetes runAsNonRoot verification Kubernetes cannot verify non-root when USER is set to a string name. The distroless nonroot user is UID 65534 — use the numeric value. - k8s/Dockerfile: USER nonroot:nonroot → USER 65534:65534 - mutator.go: add RunAsUser: 65534 to SecurityContext so Kubernetes can verify the container process is non-root
minivolk
force-pushed
the
feature/distroless-hardening
branch
3 times, most recently
from
March 29, 2026 21:56
ae8c186 to
45c818f
Compare
Replace all QEMU-based cross-compilation with native ARM64 runners (ubuntu-24.04-arm). All binaries (Rust + Go) are built natively per-architecture, then Docker images just COPY the pre-built artifacts. Pipeline restructure: - build-rust: native cargo build on amd64 + arm64 runners - build-injector: native Go build on amd64 + arm64 runners (new job) - build-envproxy-image: per-arch Docker build (just COPY, no compilation) then merge into multi-arch manifest via imagetools - build-injector-image: per-arch Docker build using Dockerfile.release (just COPY pre-built binary) then merge manifest - Remove docker/setup-qemu-action from all jobs - Remove cross tool dependency - Add Dockerfile.release for injector (no Go build stage, just distroless + COPY) - Add --prerelease flag for pre-release GitHub Releases (alpha/beta/rc) Estimated speedup: ~25 min → ~4 min total pipeline time.
minivolk
force-pushed
the
feature/distroless-hardening
branch
from
March 29, 2026 22:00
45c818f to
5ef8c58
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security hardening for all injected containers:
Dockerfile (envproxy image):