slimtoolkit/slim

build --exec will keep /bin/sh even with --include-shell=false

Open

#551 建立於 2023年7月22日

在 GitHub 查看
 (2 留言) (0 反應) (0 負責人)Go (17,694 star) (673 fork)batch import
commentenhancementhelp wantedquestion

描述

Expected Behavior

When using the build command with --include-shell=false the shell script(s) should be removed from the image

Actual Behavior

It appears as if the shell used to run the --exec script will be included in the assets to keep (probably because it is actually running at the time of analysis)

Steps to Reproduce the Problem

  1. Minimize a standard unbuntu image, do not run any script:
>~/apps/dist_linux/slim build --http-probe=false --include-shell=false ubuntu:22.04

Try to execute a shell inside the minimized image, as expected, docker will complain:

>docker run --rm -ti ubuntu.slim /bin/sh
docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "/bin/sh": stat /bin/sh: no such file or directory: unknown.
  1. Fake a script run:
~/apps/dist_linux/slim build --http-probe=false --include-shell=false --exec /bin/true ubuntu:22.04

Run the /bin/sh shell inside the trimmed image (you get a shell prompt):

>docker run --rm -ti ubuntu.slim /bin/sh
#

This is probably not a bug but an unexpected side-effect of the build internal implementation. Maybe an additional option like --run dedicated to run binary files bypassing the shell (like ENTRYPOINT do with its json array arguments) would clarify the intent and preserve the semantics of --include-shell ?

Specifications

slim version linux|Transformer|1.40.3|155f1b79556b7d100726f5ef4633f81a6ed27a2b|2023-07-13_07:46:40AM

  • Platform:
  • Distributor ID: Ubuntu Description: Ubuntu 22.04.2 LTS Release: 22.04 Codename: jammy

貢獻者指南

技術棧
goshell
領域
devops
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
half day
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
stale
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
Go basicsDocker image concepts
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
45
研究方向
Investigate the exec handling code in the build command to understand how the exec script is run and how file analysis includes the shell. The goal is to ensure that when include shell=false, the shell used to run exec is not kept in the final image. This may involve modifying the exec spawn process to avoid shell involvement or adding a new run option that runs binaries directly without a shell. Review the relevant source files, likely in the build executor or command runner, and check if there are any existing discussions or PRs addressing this issue.