Bryan Boreham
8eeb3ca4f2
This allows the main container to run without write access to the host filesystem, except for two specific areas, thus trimming the attack surface. We lose the behaviour that the CNI plugin is only installed if Weave Net gets up and running at least once, so the error reports from kubelet will be slightly different in the case that it never manages to run.
15 lines
591 B
Docker
15 lines
591 B
Docker
FROM DOCKERHUB_USER/weaveARCH_EXT
|
|
|
|
# These labels are pretty static, and can therefore be added early on:
|
|
LABEL maintainer="Weaveworks <help@weave.works>" \
|
|
org.opencontainers.image.title="weave-kube" \
|
|
org.opencontainers.image.source="https://github.com/weaveworks/weave" \
|
|
org.opencontainers.image.vendor="Weaveworks"
|
|
|
|
ADD ./init.sh ./launch.sh ./kube-utils /home/weave/
|
|
ENTRYPOINT ["/home/weave/launch.sh"]
|
|
|
|
# This label will change for every build, and should therefore be the last layer of the image:
|
|
ARG revision
|
|
LABEL org.opencontainers.image.revision="${revision}"
|