build: add distroless image variant#5258
Conversation
The distroless image runs as nonroot (UID 65532) without a shell, reducing the attack surface compared to the busybox-based image. Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
📝 WalkthroughWalkthroughA new ChangesDistroless Container Image
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile.distroless`:
- Around line 4-6: Dockerfile.distroless currently uses the distroless base
image but lacks an explicit USER instruction required by DS-0002; add an
explicit "USER 65532:65532" directive in Dockerfile.distroless just before the
final ENTRYPOINT/CMD instructions (i.e., insert USER 65532:65532 in the
Dockerfile.distroless around the end of the file) so the Dockerfile contains an
explicit non-root USER even though the base image already sets one.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1b1833eb-6206-4534-ada7-b5f124b747b8
📒 Files selected for processing (1)
Dockerfile.distroless
| FROM gcr.io/distroless/static-debian13:nonroot-${DISTROLESS_ARCH} | ||
| # Base image sets USER to 65532:65532 (nonroot user). | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Does Trivy misconfiguration rule DS-0002 ("Image user should not be 'root'") require an explicit USER instruction in the Dockerfile even when the base image already sets a non-root user?
💡 Result:
Trivy misconfiguration rule DS-0002 (also known as AVD-DS-0002) is designed to ensure that containers do not run as the root user [1][2]. The rule specifically checks for the presence of a USER instruction in the Dockerfile [1][3]. Historically, this rule has been interpreted by the scanner as requiring an explicit USER instruction within the Dockerfile itself, regardless of whether the base image defines a non-root user [1][4]. If the Dockerfile lacks a USER instruction, Trivy may flag a DS-0002 violation even if the resulting image is effectively configured to run as a non-root user due to the base image settings [1][4]. Users have reported this behavior as a pain point in various scenarios, such as when using base images that already specify a non-root user [1][3]. While updates to Trivy have occasionally introduced regressions or changes in how strictly this is enforced, the rule's primary logic remains focused on validating the Dockerfile configuration [1][5][4]. If you encounter this issue, you have a few options: 1. Explicitly add a USER instruction to your Dockerfile (e.g., USER ) to satisfy the scanner [6][7]. 2. If you are certain your image is secure, you can ignore the finding using a.trivyignore.yaml file [8]. Inline comments for ignoring this specific rule are generally not supported because the check is triggered by the absence of the instruction [8]. 3. Ensure you are using the latest version of Trivy, as the maintainers continue to refine how the scanner interprets image metadata versus Dockerfile content [1][5].
Citations:
- 1: Trivy 0.49.0 regression: image misconfiguration incorrectly reports ds002: Specify at least 1 USER command in Dockerfile with non-root user as argument aquasecurity/trivy#6069
- 2: https://trivy.dev/docs/latest/configuration/filtering/
- 3: Image misconfiguration fails scanning Iron Bank images aquasecurity/trivy#9484
- 4: Docker multistage build using single USER in the last stage produces MISCONF DS002 aquasecurity/trivy#1620
- 5: bug(misconf): AVD-DS-0002 not detected against image aquasecurity/trivy#8406
- 6: https://dev.to/parag477/how-to-write-a-production-ready-dockerfile-with-examples-for-nodejs-and-python-o1d
- 7: https://dev.to/raju_dandigam/optimizing-docker-images-for-typescript-ai-agents-with-dive-and-multi-stage-builds-3gho
- 8: https://trivy.dev/docs/latest/guide/scanner/misconfiguration/config/config/
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ls -la
find . -maxdepth 4 -name 'Dockerfile.distroless' -print
if [ -f Dockerfile.distroless ]; then
echo '--- Dockerfile.distroless (first 120 lines) ---'
cat -n Dockerfile.distroless | head -n 120
else
# if not at repo root, print the first match
f="$(find . -name 'Dockerfile.distroless' -print -quit)"
echo "--- Found $f ---"
cat -n "$f" | head -n 200
fiRepository: prometheus/alertmanager
Length of output: 5440
Add an explicit USER in Dockerfile.distroless to satisfy DS-0002
Dockerfile.distroless uses gcr.io/distroless/static-debian13:nonroot-${DISTROLESS_ARCH} but contains no USER directive; Trivy’s DS-0002 logic checks for an explicit USER instruction in the Dockerfile (even when the base image already sets a non-root user). Add USER 65532:65532 before the ENTRYPOINT/CMD (around lines 25–29).
Suggested patch
WORKDIR /alertmanager
EXPOSE 9093
+USER 65532:65532
ENTRYPOINT [ "/bin/alertmanager" ]
CMD [ "--config.file=/etc/alertmanager/alertmanager.yml", \
"--storage.path=/alertmanager" ]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile.distroless` around lines 4 - 6, Dockerfile.distroless currently
uses the distroless base image but lacks an explicit USER instruction required
by DS-0002; add an explicit "USER 65532:65532" directive in
Dockerfile.distroless just before the final ENTRYPOINT/CMD instructions (i.e.,
insert USER 65532:65532 in the Dockerfile.distroless around the end of the file)
so the Dockerfile contains an explicit non-root USER even though the base image
already sets one.
1 participant
The distroless image runs as nonroot (UID 65532) without a shell, reducing the attack surface compared to the busybox-based image.
Pull Request Checklist
Please check all the applicable boxes.
benchstatto compare benchmarksWhich user-facing changes does this PR introduce?
Summary by CodeRabbit