Ensure static linked binary and bump distroless#717
Conversation
friegger
added
ok-to-image
and removed
bug
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe Dockerfile build process is updated to disable CGO (via Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
Dockerfile (1)
62-62: Consider pinning the distroless base image by digest for reproducibility.Using
gcr.io/distroless/base-debian12as a floating tag makes builds less reproducible and complicates supply-chain tracking. Pin to a specific platform digest (e.g.,gcr.io/distroless/base-debian12:latest-amd64@sha256:...) for immutable, traceable deployments. Note that this is a multi-platform image index, so each target platform requires its own digest; obtain it viadocker inspectorskopeo inspectfor your build architecture.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` at line 62, The Dockerfile uses a floating base image "gcr.io/distroless/base-debian12" in the stage named libvirt-provider; replace that floating tag with a specific platform digest (e.g., gcr.io/distroless/base-debian12@sha256:<digest>) to make builds reproducible and supply-chain traceable, obtaining the correct digest for your target architecture via docker inspect or skopeo inspect and updating the FROM line accordingly (one digest per platform).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@Dockerfile`:
- Line 62: The Dockerfile uses a floating base image
"gcr.io/distroless/base-debian12" in the stage named libvirt-provider; replace
that floating tag with a specific platform digest (e.g.,
gcr.io/distroless/base-debian12@sha256:<digest>) to make builds reproducible and
supply-chain traceable, obtaining the correct digest for your target
architecture via docker inspect or skopeo inspect and updating the FROM line
accordingly (one digest per platform).
Also use static, since we don't need libc etc when using a staticly linked go binary.
3 participants
The default for
CGO_ENABLEDis true for regular builds. This results in a dynamically linked binary against e.g. glibc of the system where the binary was built. SettingCGO_ENABLEDto false ensures statically linked binaries are created.This enables also to run on distoless static build.
Summary by CodeRabbit