Repository navigation
lifecycle/container: add a distroless version of the server image - #26321
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## container-test-kit #26321 +/- ##
======================================================
+ Coverage 92.37% 92.38% +0.01%
======================================================
Files 1189 1190 +1
Lines 80137 80148 +11
Branches 4351 4351
======================================================
+ Hits 74023 74044 +21
+ Misses 6048 6038 -10
Partials 66 66
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
✅ Deploy Preview for authentik-integrations ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Playwright e2eDownload this run's HTML report and traces, then open the report: gh run download 39631666753 -D playwright-artifacts
npx playwright show-report playwright-artifacts/playwright-reportInstallation instructionsInstructions for docker-composeAdd the following block to your AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-21f608e1991417b770670297f71f3fae202b3ee5
# Distroless image: AUTHENTIK_TAG=gh-21f608e1991417b770670297f71f3fae202b3ee5-distroless
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)sAfterwards, run the upgrade commands from the latest release notes. Instructions for KubernetesAdd the following block to your authentik:
outposts:
container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
image:
repository: ghcr.io/goauthentik/dev-server
tag: gh-21f608e1991417b770670297f71f3fae202b3ee5
# Distroless image: tag: gh-21f608e1991417b770670297f71f3fae202b3ee5-distrolessAfterwards, run the upgrade commands from the latest release notes. |
2722a9d to
ffadc72
Compare
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The final image omits required merged-/usr symlinks, and two build stages still reference temporary upstream PR images.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (2)
What changed in this PR
Converts the authentik server image to a curated, distroless filesystem built from scratch.
Changes:
- Adds package, runtime-path, and exclusion allowlists.
- Adds a pruning script to assemble the minimal root filesystem.
- Preserves the unpruned debug image.
| File | Description |
|---|---|
lifecycle/container/runtime-paths.txt |
Lists non-package runtime files. |
lifecycle/container/runtime-packages.txt |
Lists retained Debian packages. |
lifecycle/container/runtime-drop.txt |
Removes development and interactive tooling. |
lifecycle/container/prune.sh |
Builds the pruned filesystem. |
lifecycle/container/Dockerfile |
Creates the scratch-based final image. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
dominic-r
left a comment
dominic-r
left a comment
There was a problem hiding this comment.
Was trying it out for myself and had 2 questions
| # writable mount points | ||
| /certs | ||
| /data | ||
| /media |
There was a problem hiding this comment.
Since 2025.12, this has moved to /data, so I feel like this should be removed. It's nearly been a year
There was a problem hiding this comment.
removing it could break pre-2025.12 setups though, right? or did we force-migrate it somehow?
There was a problem hiding this comment.
seems like it's still symlinked:
authentik/lifecycle/container/Dockerfile
Line 268 in 504b1e2
-> I'd keep it
There was a problem hiding this comment.
removing it could break pre-2025.12 setups though, right? or did we force-migrate it somehow?
if ur running pre .12 a year later that's kind of on you plus the .12 images were already published (with the appropriate paths) so it shouldn't be an issue unless we're planning on backfilling the rootless images, which we shouldn't imo
There was a problem hiding this comment.
no, I mean if you had setup authentik pre-2025.12, you probably have /media
existing setups didn't break past 2025.12 because of this symlink:
authentik/lifecycle/container/Dockerfile
Line 268 in 504b1e2
-> removing it would break that setup
it's far less of an issue now that distroless is not the "main" image, but then again what's the harm in keeping it?
522ee23 to
cabb84b
Compare
✅ Deploy Preview for authentik-storybook ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
cabb84b to
044279c
Compare
a09ba4c to
1e2d518
Compare
81c4521 to
504b1e2
Compare
154eb43 to
8029c37
Compare
8029c37 to
e52b419
Compare
e52b419 to
1464de3
Compare
7488c5e to
40cd7b3
Compare
40cd7b3 to
67a9717
Compare
github-project-automation
Bot
moved this from Needs review
to In Progress
in authentik Core
0ae412c to
cac236b
Compare
Co-authored-by: Emil Burzo <contact@emilburzo.com> Signed-off-by: Emil Burzo <contact@emilburzo.com>
cac236b to
21f608e
Compare
* main: (21 commits) root: require Node.js 24.22.1 (#27093) website/docs: change routing info after 2026.8 changes (#27109) core: bump astral-sh/uv from 0.13.4 to 0.13.5 in /lifecycle/container (#27096) flows: avoid saving plan history when inspector inaccessible (#27089) core: bump pyo3 from 0.29.0 to 0.30.1 (#27099) core: bump arc-swap from 1.9.2 to 1.9.3 (#27098) core: bump pyroscope-io from 1.2.5 to 1.3.0 (#27100) core: bump pyo3-build-config from 0.29.0 to 0.30.1 (#27097) core: bump dexidp/dex from v2.46.0 to v2.46.1 in /tests/e2e (#27095) website/integrations: VCF 9: touch up (#27094) lifecycle/container: add a distroless version of the server image (#26321) ci: run tests in the server image (#26510) packages/client-ts: Generate imports with `.js` extensions (#27029) core: bump djangorestframework from 3.18.1 to 3.18.3 (#26838) website/docs: add release notes for `2026.8.5` (#27084) website/docs: add release notes for `2026.5.8` (#27083) core, web: update translations (#27035) core: bump twilio from 9.11.2 to 9.12.0 (#27081) core: bump cachetools from 7.2.2 to 7.2.3 (#27082) core: bump paramiko from 5.0.0 to 5.0.1 (#27080) ...
…ts/sidebar-api-disconnect * web/elements/sidebar-footer-dependency: (27 commits) The test exists and passes. Moving the load of the AdminOverviewPage to the entrypoint. The idea is to have the dashboard as live as possible as early as possible. Putting into Routes made Routes into a browser-only feature, and it could not be unit tested without this move. web/elements: test that ak-mdx does not evaluate API-supplied content (#24524) root: require Node.js 24.22.1 (#27093) Formatter opinions. That side effect infected downstream tests. Darnit. web/admin: Simplify sidebar entries handling website/docs: change routing info after 2026.8 changes (#27109) core: bump astral-sh/uv from 0.13.4 to 0.13.5 in /lifecycle/container (#27096) flows: avoid saving plan history when inspector inaccessible (#27089) core: bump pyo3 from 0.29.0 to 0.30.1 (#27099) core: bump arc-swap from 1.9.2 to 1.9.3 (#27098) core: bump pyroscope-io from 1.2.5 to 1.3.0 (#27100) core: bump pyo3-build-config from 0.29.0 to 0.30.1 (#27097) core: bump dexidp/dex from v2.46.0 to v2.46.1 in /tests/e2e (#27095) website/integrations: VCF 9: touch up (#27094) lifecycle/container: add a distroless version of the server image (#26321) ci: run tests in the server image (#26510) packages/client-ts: Generate imports with `.js` extensions (#27029) core: bump djangorestframework from 3.18.1 to 3.18.3 (#26838) ...
No description provided.