Repository navigation
Build the Go image from scratch instead of Debian #33
Description
This repository builds the cloud image from a static Go binary on a Debian-based distroless image, so a Debian CA or package update reaches production only through a rebuild. A scratch base carries nothing but the binary and the files copied in beside it, which drops the Debian packages the service never uses. The CA list then comes from a file this repository copies in, so it needs a named, current source. Time zone data and the non-root user have to be added the same way if the service uses them.
Success looks like
- Every image builds from scratch and passes this repository's tests and e2e
- The CA list comes from one named, current source that a root removal updates without a hand edit
- Every image runs as a non-root user, with time zone data where the service needs it
Related to datum-cloud/infra#7436
Activity
ecv commentedon Oct 21, 2026
Reopened. #34 was reverted in #35: the scratch image ran with group 0 in the cluster, so the pod could not read its cert-manager CSI client certificate. A retry needs a minimal /etc/passwd and /etc/group, or runAsGroup 65532, and a check of the staging pod's group before merge. Related to datum-cloud/infra#7436.