slimtoolkit/slim

build --exec will keep /bin/sh even with --include-shell=false

Open

#551 opened on 2023年7月22日

GitHub で見る
 (2 comments) (0 reactions) (0 assignees)Go (17,694 stars) (673 forks)batch import
commentenhancementhelp wantedquestion

説明

Expected Behavior

When using the build command with --include-shell=false the shell script(s) should be removed from the image

Actual Behavior

It appears as if the shell used to run the --exec script will be included in the assets to keep (probably because it is actually running at the time of analysis)

Steps to Reproduce the Problem

  1. Minimize a standard unbuntu image, do not run any script:
>~/apps/dist_linux/slim build --http-probe=false --include-shell=false ubuntu:22.04

Try to execute a shell inside the minimized image, as expected, docker will complain:

>docker run --rm -ti ubuntu.slim /bin/sh
docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "/bin/sh": stat /bin/sh: no such file or directory: unknown.
  1. Fake a script run:
~/apps/dist_linux/slim build --http-probe=false --include-shell=false --exec /bin/true ubuntu:22.04

Run the /bin/sh shell inside the trimmed image (you get a shell prompt):

>docker run --rm -ti ubuntu.slim /bin/sh
#

This is probably not a bug but an unexpected side-effect of the build internal implementation. Maybe an additional option like --run dedicated to run binary files bypassing the shell (like ENTRYPOINT do with its json array arguments) would clarify the intent and preserve the semantics of --include-shell ?

Specifications

slim version linux|Transformer|1.40.3|155f1b79556b7d100726f5ef4633f81a6ed27a2b|2023-07-13_07:46:40AM

  • Platform:
  • Distributor ID: Ubuntu Description: Ubuntu 22.04.2 LTS Release: 22.04 Codename: jammy

コントリビューターガイド

技術スタック
goshell
領域
devops
Issue 種別
bug
難度新しい貢献者にとっての実装難度です。1 は非常に小さな変更、5 は専門的な作業です。
3
推定時間経験ある貢献者が調査、実装、テスト、pull request 準備にかけるおおよその時間範囲です。
half day
活動状況Issue が今どれだけ取り組みやすいかを示します。新しい、活発、古い、ブロック中、またはメンテナー入力待ちなどです。
stale
明確さ期待される変更、受け入れ条件、次の手順がどれだけ明確かを示します。
clear
前提条件
Go basicsDocker image concepts
初心者向け度初回貢献者にどれだけ取り組みやすいかを 1-100 で推定したスコアです。
45
調査方針
Investigate the exec handling code in the build command to understand how the exec script is run and how file analysis includes the shell. The goal is to ensure that when include shell=false, the shell used to run exec is not kept in the final image. This may involve modifying the exec spawn process to avoid shell involvement or adding a new run option that runs binaries directly without a shell. Review the relevant source files, likely in the build executor or command runner, and check if there are any existing discussions or PRs addressing this issue.