Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

feat: make supervisor base image configurable via build ARG

未关闭 适合新手
  • 哪里不对？
#4,205 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
84/100
Issue 类型
功能
描述清晰度
描述清楚
活跃度
活跃
技术栈
docker
领域
build-system, devops

调研方向

首先比较 deploy/docker/Dockerfile.supervisor 和 deploy/docker/Dockerfile.gateway，并阅读 architecture/build.md 中关于基础镜像的文档。添加 supervisor 覆盖项，并将当前固定的镜像用作默认值，然后分别在有覆盖项和没有覆盖项的情况下构建，以检查默认行为和可配置性。完成标准是文档涵盖这两个覆盖项，且默认值保持不变。

由索引模型根据 Issue 内容生成。

描述

state:triage-needed

User Story

As an operator or downstream packager deploying OpenShell's supervisor container in an environment with specific registry-trust, compliance, or support constraints (e.g. a registry allowlist, a FIPS-validated base image requirement, or an internal support SLA tied to a specific image vendor), I want to override the supervisor's base image at build time, so that I can satisfy my environment's constraints without forking the Dockerfile.

Problem Statement

deploy/docker/Dockerfile.gateway already exposes its base image as a build ARG:

ARG GATEWAY_BASE_IMAGE=gcr.io/distroless/cc-debian13:nonroot@sha256:54df941ed0d06a1bd95ef5e0ce391fd8d9f94b64782dc9a60062727849ee3f97
FROM ${GATEWAY_BASE_IMAGE} AS gateway

deploy/docker/Dockerfile.supervisor does not. It hardcodes:

FROM gcr.io/distroless/base-nossl-debian13@sha256:af5cb8dd589b8520b8c06bebb9efb73d7e16406cab58e85c51761fff49d370a0 AS supervisor

There is no equivalent override point, so substituting an alternate base image for the supervisor today requires forking/patching the Dockerfile.

Impact / Why This Matters

Downstream consumers building in a registry-restricted environment, needing a FIPS-validated base, or needing a base image they can patch/support on their own schedule currently have to maintain a forked Dockerfile to get a different supervisor base image. A fork drifts from upstream over time (missed binary/build-step changes) and duplicates this maintenance burden across every downstream consumer who needs it. The gateway already solves this cleanly; the supervisor's inconsistency with that pattern is the actual gap, not a missing capability invented from scratch.

Proposed Design

Add a build ARG to deploy/docker/Dockerfile.supervisor (e.g. SUPERVISOR_BASE_IMAGE) defaulting to the current pinned image/digest, mirroring GATEWAY_BASE_IMAGE's existing pattern. This is purely additive: no default behavior change, and no change to published images unless a builder explicitly overrides the ARG. Exact ARG naming/defaulting mechanics are left to the implementing PR.

Acceptance Criteria

  • deploy/docker/Dockerfile.supervisor accepts a build ARG for its base image, with the current image pinned as the default.
  • Building without overriding the ARG produces the same image as today (no default-behavior change).
  • Wherever the gateway's GATEWAY_BASE_IMAGE override is documented (e.g. architecture/build.md) is updated to document the supervisor's new equivalent consistently.

Alternatives Considered

  • Status quo (hardcoded base, consumers fork the Dockerfile if they need something else) — rejected: duplicates maintenance effort per downstream consumer and drifts from upstream over time.
  • Change the default base image itself (e.g. to Red Hat's Project Hummingbird registry.access.redhat.com/hi/core-runtime) — rejected for now: a direct comparison (skopeo inspect against both) shows Hummingbird's core-runtime image is larger and has more layers than the current default (12.82 MB / 23 layers vs. the current base's 5.94 MB / 14 layers), and its image config sets CMD ["/bin/bash"], suggesting a shell may be present where the current distroless base has none. It is not a demonstrated improvement, and changing the project's default base is a larger decision needing broader maintainer alignment, not a mechanical change.
  • Make the sandbox image configurable the same way (deploy/docker/Dockerfile.sandbox, FROM scratch) — rejected: the sandbox image has no runtime base to swap, it's a bare static binary with no base at all, so this axis doesn't apply there.

Agent Investigation

Confirmed by reading the current Dockerfiles directly and inspecting published images/registries with skopeo inspect:

  • deploy/docker/Dockerfile.gateway already has the GATEWAY_BASE_IMAGE ARG described above.
  • deploy/docker/Dockerfile.supervisor has no equivalent ARG.
  • deploy/docker/Dockerfile.sandbox is FROM scratch with no base image to parameterize.
  • Published ghcr.io/nvidia/openshell/supervisor:dev is 15 layers / ~19.6 MB total; its base (distroless/base-nossl-debian13) is 14 layers / ~5.94 MB.
  • registry.access.redhat.com/hi/core-runtime:latest (Project Hummingbird's comparable minimal base) is 23 layers / ~12.82 MB, with image config CMD ["/bin/bash"].

No RFC needed — this is a small, additive, non-breaking build-configuration change, not a change to OpenShell's architecture or default behavior.

主要语言
Rust
星标
13.2k
派生
1.6k
平均合并
1 天 19 小时
30 天内合并 PR
330

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

NVIDIA/OpenShell 的其他 Issue

查看 NVIDIA/OpenShell 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。