Skip to content

[image-provider]: replace bookworm image with nonroot alpine image#2193

Merged
julianocosta89 merged 6 commits intoopen-telemetry:mainfrom
Red-GV:nonroot-image-provider
Jun 17, 2025
Merged

[image-provider]: replace bookworm image with nonroot alpine image#2193
julianocosta89 merged 6 commits intoopen-telemetry:mainfrom
Red-GV:nonroot-image-provider

Conversation

@Red-GV
Copy link
Copy Markdown
Contributor

@Red-GV Red-GV commented May 20, 2025

Changes

This PR updates the image-provider image to use an alpine with that runs as a non-root user. This allows the service to run in an environment which does not allow privileged users.

Merge Requirements

For new features contributions, please make sure you have completed the following
essential items:

  • CHANGELOG.md updated to document new feature additions
  • Appropriate documentation updates in the docs
  • Appropriate Helm chart updates in the helm-charts

Maintainers will not merge until the above have been completed. If you're unsure
which docs need to be changed ping the
@open-telemetry/demo-approvers.

@Red-GV Red-GV requested a review from a team as a code owner May 20, 2025 23:06
@Red-GV
Copy link
Copy Markdown
Contributor Author

Red-GV commented May 20, 2025

This differences in image sizes can be documented here.

Screenshot 2025-05-20 at 7 01 16 PM

Signed-off-by: Gerard Vanloo <gerard.vanloo@ibm.com>
@Red-GV Red-GV force-pushed the nonroot-image-provider branch from 4490dd4 to 89d5513 Compare May 20, 2025 23:09
Copy link
Copy Markdown
Member

@julianocosta89 julianocosta89 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but I won't merge this one now.
I'd like to hear the opinions from @puckpuck and @mviitane.

This PR changes the base image from nginx:1.27.0-otel to nginxinc/nginx-unprivileged:1.27.5-alpine3.21.

Initially I was concerned about it, but when checking Running nginx as a non-root user at https://hub.docker.com/_/nginx I saw they do recommend https://hub.docker.com/r/nginxinc/nginx-unprivileged.

So I'm fine with the change. Any objections?

@Red-GV
Copy link
Copy Markdown
Contributor Author

Red-GV commented May 21, 2025

@julianocosta89 One thing I thought of, this might require a Helm chart update after the next release of this image so that the podSecurityContext can be updated.

@Red-GV
Copy link
Copy Markdown
Contributor Author

Red-GV commented Jun 2, 2025

Hello, just a small reminder about this PR @puckpuck @mviitane @julianocosta89

@github-actions
Copy link
Copy Markdown

This PR was marked stale due to lack of activity. It will be closed in 7 days.

Copy link
Copy Markdown
Contributor

@rogercoll rogercoll left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM (In favor of making the demo more light way). Also, as @julianocosta89 mentioned, nginxinc/nginx-unprivileged is the Nginx's recommended image for non root.

@julianocosta89 julianocosta89 merged commit 8edb420 into open-telemetry:main Jun 17, 2025
31 checks passed
@Red-GV Red-GV deleted the nonroot-image-provider branch June 17, 2025 13:53
orkhanM pushed a commit to crashoverride-poc/opentelemetry-demo that referenced this pull request Jun 24, 2025
…pen-telemetry#2193)

Signed-off-by: Gerard Vanloo <gerard.vanloo@ibm.com>
Co-authored-by: Juliano Costa <julianocosta89@outlook.com>
rnjn pushed a commit to base-14/opentelemetry-demo that referenced this pull request Jul 28, 2025
…pen-telemetry#2193)

Signed-off-by: Gerard Vanloo <gerard.vanloo@ibm.com>
Co-authored-by: Juliano Costa <julianocosta89@outlook.com>
cloud-hb pushed a commit to cloud-hb/opentelemetry-demo that referenced this pull request Nov 17, 2025
…pen-telemetry#2193)

Signed-off-by: Gerard Vanloo <gerard.vanloo@ibm.com>
Co-authored-by: Juliano Costa <julianocosta89@outlook.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants