Compare commits

...

2 Commits

Author SHA1 Message Date
Claude Bot
7e2d748156 chore: remove unnecessary test script 2025-09-12 14:06:39 +00:00
Claude Bot
62ad6a2bc9 fix: Docker distroless build failure and security updates
- Fix distroless build failure by replacing heredoc syntax with explicit shell call
  - Distroless has no shell, must use /bin/sh from build stage mounts
  - Fixes CI/CD pipeline that has been failing for months (#20414)

- Security updates for base images:
  - Distroless: debian11 → debian12 (addresses CVEs in #22594)
  - Alpine: 3.20 → 3.21 (latest stable)

- Fix incorrect symlink name 'nodebun' → 'node' in distroless

This minimal fix addresses the critical issue preventing distroless images
from being published while maintaining the minimal attack surface philosophy
of distroless containers.
2025-09-12 13:59:33 +00:00
2 changed files with 11 additions and 10 deletions

View File

@@ -1,4 +1,4 @@
FROM alpine:3.20 AS build
FROM alpine:3.21 AS build
# https://github.com/oven-sh/bun/releases
ARG BUN_VERSION=latest
@@ -44,7 +44,7 @@ RUN apk --no-cache add ca-certificates curl dirmngr gpg gpg-agent unzip \
&& rm -f "bun-linux-$build.zip" SHASUMS256.txt.asc SHASUMS256.txt \
&& chmod +x /usr/local/bin/bun
FROM alpine:3.20
FROM alpine:3.21
# Disable the runtime transpiler cache by default inside Docker containers.
# On ephemeral containers, the cache is not useful

View File

@@ -55,7 +55,7 @@ RUN apt-get update -qq \
&& which bun \
&& bun --version
FROM gcr.io/distroless/base-nossl-debian11
FROM gcr.io/distroless/base-nossl-debian12
# Disable the runtime transpiler cache by default inside Docker containers.
# On ephemeral containers, the cache is not useful
@@ -69,16 +69,17 @@ ENV BUN_INSTALL_BIN=${BUN_INSTALL_BIN}
COPY --from=build /usr/local/bin/bun /usr/local/bin/
ENV PATH "${PATH}:/usr/local/bun-node-fallback-bin"
# Temporarily use the `build`-stage image binaries to create a symlink:
# Temporarily use the `build`-stage image binaries to create symlinks:
# We must use the shell from the build stage since distroless has no shell
RUN --mount=type=bind,from=build,source=/usr/bin,target=/usr/bin \
--mount=type=bind,from=build,source=/bin,target=/bin \
--mount=type=bind,from=build,source=/usr/lib,target=/usr/lib \
--mount=type=bind,from=build,source=/lib,target=/lib \
<<EOF
ln -s /usr/local/bin/bun /usr/local/bin/bunx
which bunx
mkdir -p /usr/local/bun-node-fallback-bin
ln -s /usr/local/bin/bun /usr/local/bun-node-fallback-bin/nodebun
EOF
/bin/sh -c ' \
ln -s /usr/local/bin/bun /usr/local/bin/bunx && \
which bunx && \
mkdir -p /usr/local/bun-node-fallback-bin && \
ln -s /usr/local/bin/bun /usr/local/bun-node-fallback-bin/node \
'
ENTRYPOINT ["/usr/local/bin/bun"]