552fb3e4cc
This patch adjusts the distroless image to use the predefined non-root UID, which uses explicit UID definitions. This allows orchestrators like Kubernetes to validate non-zero UIDs directly by checking the Image metadata. The previous setup without an explicit `runAsUser` in the securityContext would produce the following error when enabling `runAsNonRoot`: ``` Error: container has runAsNonRoot and image has non-numeric user (nonroot), cannot verify user is non-root (pod: "miniflux-97cc5955f-pt7vf_miniflux(d1c56d29-ea0a-407c-b3f3-9821fbd7ee61)", container: miniflux) ```
23 lines
983 B
Docker
23 lines
983 B
Docker
FROM golang:latest AS build
|
|
ENV CGO_ENABLED=0
|
|
ADD . /go/src/app
|
|
WORKDIR /go/src/app
|
|
RUN go build \
|
|
-o miniflux \
|
|
-ldflags="-s -w -X 'miniflux.app/v2/internal/version.Version=`git describe --tags --abbrev=0`' -X 'miniflux.app/v2/internal/version.Commit=`git rev-parse --short HEAD`' -X 'miniflux.app/v2/internal/version.BuildDate=`date +%FT%T%z`'" \
|
|
main.go
|
|
|
|
FROM gcr.io/distroless/base:nonroot
|
|
|
|
LABEL org.opencontainers.image.title=Miniflux
|
|
LABEL org.opencontainers.image.description="Miniflux is a minimalist and opinionated feed reader"
|
|
LABEL org.opencontainers.image.vendor="Frédéric Guillot"
|
|
LABEL org.opencontainers.image.licenses=Apache-2.0
|
|
LABEL org.opencontainers.image.url=https://miniflux.app
|
|
LABEL org.opencontainers.image.source=https://github.com/miniflux/v2
|
|
LABEL org.opencontainers.image.documentation=https://miniflux.app/docs/
|
|
|
|
EXPOSE 8080
|
|
ENV LISTEN_ADDR 0.0.0.0:8080
|
|
COPY --from=build /go/src/app/miniflux /usr/bin/miniflux
|
|
CMD ["/usr/bin/miniflux"]
|