update dockerfile#763
Conversation
Signed-off-by: Sri Vignesh <sselvan@redhat.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request configures proxy environment variables and updates several tool versions (TKN, Gauge, Cosign, and Golangci-lint) in the CI Dockerfile. The reviewer identified three key issues: hardcoding proxy variables with ENV instead of ARG which limits portability, removing explicit file extraction from the tkn tarball which can pollute /usr/bin, and using an invalid version format for golangci-lint (v2.x.y instead of v1.x.y) which will cause the build to fail with a 404 error.
| chmod u+x /usr/bin/rekor-cli | ||
|
|
||
| ENV GOLANGCI_LINT_VERSION=2.11.4 | ||
| ENV GOLANGCI_LINT_VERSION=2.12.2 |
There was a problem hiding this comment.
The golangci-lint project uses v1.x.y versioning (e.g., 1.62.2). There is no version 2.12.2 (or the previous 2.11.4), and attempting to download this version will result in a 404 Not Found error, breaking the Docker build. Please use a valid v1.x.y version.
ENV GOLANGCI_LINT_VERSION=1.62.2
| @@ -1,5 +1,9 @@ | |||
| FROM quay.io/fedora/fedora:44 | |||
|
|
|||
| ENV HTTP_PROXY=http://squid.corp.redhat.com:3128 | |||
There was a problem hiding this comment.
Using ENV to set proxy variables hardcodes them into the final image. This means any container run from this image will attempt to route its traffic through the Red Hat corporate proxy, which will fail when run outside of the Red Hat network. To configure proxies for the build process without persisting them in the final image, use ARG instead of ENV for HTTP_PROXY, HTTPS_PROXY, and NO_PROXY.
ARG HTTP_PROXY=http://squid.corp.redhat.com:3128
| RUN wget https://developers.redhat.com/content-gateway/rest/browse/pub/cgw/pipelines/${TKN_VERSION}/tkn-linux-amd64.tar.gz \ | ||
| -O /tmp/tkn.tar.gz &&\ | ||
| tar xzf /tmp/tkn.tar.gz -C /usr/bin --no-same-owner tkn tkn-pac opc &&\ | ||
| tar xzf /tmp/tkn.tar.gz --no-same-owner -C /usr/bin &&\ |
There was a problem hiding this comment.
Removing the explicit list of files (tkn tkn-pac opc) from the tar extraction command will extract all files in the archive (including metadata, licenses, or READMEs) directly into /usr/bin. It is cleaner and safer to explicitly extract only the required binaries to avoid polluting /usr/bin.
tar xzf /tmp/tkn.tar.gz --no-same-owner -C /usr/bin tkn tkn-pac opc &&\
1 participant
No description provided.