Harden Container Runtime with Non-Root User (#3941)

* Update Dockerfile Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update Dockerfile Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update validations.yaml Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update validations.yaml Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update Dockerfile Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update validations.yaml Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update Dockerfile Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update .goreleaser.yaml Signed-off-by: Michael Briley <michael.briley937@gmail.com> * Update .goreleaser.yaml Signed-off-by: Michael Briley <michael.briley937@gmail.com> * use distroless/static-debian12:nonroot directly Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep manual manifest curation Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * remove qemu usage Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * add smoke test for snapshot Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * split up manifests section with comments Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * correct ci step name Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * fix arch condition Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * keep path prefix Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Michael Briley <michael.briley937@gmail.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
2026-10-30 14:02:26 +01:00 · 2025-06-05 12:36:23 -04:00
parent bd894b9c4d
commit 868a6a7584
5 changed files with 124 additions and 123 deletions
@@ -27,10 +27,12 @@ vars:
    sh: uname -s | tr '[:upper:]' '[:lower:]'
  ARCH:
    sh: |
-      [ "$(uname -m)" = "x86_64" ] && echo "amd64_v1" || { [ "$(uname -m)" = "aarch64" ] && echo "arm64_v8.0" || echo $(uname -m); }
+      [ "$(uname -m)" = "x86_64" ] && echo "amd64_v1" || { [ "$(uname -m)" = "aarch64" ] && echo "arm64_v8.0" || [ "$(uname -m)" = "arm64" ] && echo "arm64_v8.0" || echo $(uname -m); }
  PROJECT_ROOT:
    sh: echo $PWD
+
  # note: the snapshot dir must be a relative path starting with ./
+  # e.g. when installing snapshot debs from a local path, ./ forces the deb to be installed in the current working directory instead of referencing a package name
  SNAPSHOT_DIR: ./snapshot
  SNAPSHOT_BIN: "{{ .PROJECT_ROOT }}/{{ .SNAPSHOT_DIR }}/{{ .OS }}-build_{{ .OS }}_{{ .ARCH }}/{{ .PROJECT }}"
  SNAPSHOT_CMD: "{{ .TOOL_DIR }}/goreleaser release --config {{ .TMP_DIR }}/goreleaser.yaml --clean --snapshot --skip=publish --skip=sign"
@@ -230,10 +232,7 @@ tasks:

  cli:
    desc: Run CLI tests
-    # note: we don't want to regenerate the snapshot unless we have to. In CI it's probable
-    # that the cache being restored with the correct binary will be rebuilt since the timestamps
-    # and local checksums will not line up.
-    deps: [tools, snapshot]
+    deps: [tools]
    cmds:
      - cmd: "echo 'testing binary: {{ .SNAPSHOT_BIN }}'"
        silent: true
@@ -573,6 +572,18 @@ tasks:

      - "{{ .SNAPSHOT_CMD }}"

+  snapshot-smoke-test:
+    desc: Run a smoke test on the snapshot builds + docker images
+    cmds:
+      - cmd: "echo 'testing snapshot binary: {{ .SNAPSHOT_BIN }}'"
+        silent: true
+      - cmd: "test -f {{ .SNAPSHOT_BIN }} || (find {{ .SNAPSHOT_DIR }} && echo '\nno snapshot found for {{ .SNAPSHOT_BIN }}' && false)"
+        silent: true
+      - "{{ .SNAPSHOT_BIN }} version"
+      - "{{ .SNAPSHOT_BIN }} scan alpine:latest"
+      - docker run --rm anchore/syft:latest version
+      - docker run --rm anchore/syft:latest scan alpine:latest
+
  changelog:
    desc: Generate a changelog
    deps: [tools]