support usrmerged /bin and /sbin #1477
Conversation
Distros are adopting the merged /usr directories scheme where the /{bin,sbin,lib}/
directories are made symbolic links to /usr/{bin,sbin,lib}/.
There are use cases where this could be justified for Distroless
as well. For example, a statically built Busybox/Toybox w/ built-in
shell can be installed to /usr/bin and still have the typical
shellscript shebangs (/bin/sh or /bin/bash) working.
However, Debian 11/12 base packages (base-files, libc6 etc) do not
support the merged /usr so it's not very straightfoward to enable
for Distroless.
One approach to support this for /bin/ and /sbin is to create a
layer with whiteouts and symlinks. Tests are also added to ensure
any Distroless image flavor does not overwrite the symlinks created
in that lower layer.
Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>
|
I think we can modify the deb package processor to be merge file system aware. But we'd start to get into very strange territory. What we'd ideally want to do is prevent ALL layers from writing to /bin and /sbin and force the build config to ensure this never happens. |
Yup, agreed. I'm currently testing one idea on my side to workaround the limitation so maybe I'm able to sort this out without any Distroless changes needed after all. Just wanted to share this draft since I had it ready. |
|
For me, |
|
Yeah unfortunately it's a rather annoying problem given our build |
Distros are adopting the merged /usr directories scheme where the /{bin,sbin,lib}/ directories are made symbolic links to /usr/{bin,sbin,lib}/.
There are use cases where this could be justified for Distroless as well. For example, a statically built Busybox/Toybox w/ built-in shell can be installed to /usr/bin and still have the typical shellscript shebangs (/bin/sh or /bin/bash) working.
However, Debian 11/12 base packages (base-files, libc6 etc) do not support the merged /usr so it's not very straightfoward to enable for Distroless.
One approach to support this for /bin/ and /sbin is to create a layer with whiteouts and symlinks. Tests are also added to ensure any Distroless image flavor does not overwrite the symlinks created in that lower layer.