martinclaus/image-registry-checker

Webservice to check is a container image exists in a registry

image-registry-checker's Issues

Runs as root in Kubernetes only

Deploying this application as a Kubernetes service basically works,

---
apiVersion: v1
kind: Namespace
metadata:
  name: registry-checker
---
apiVersion: v1
kind: Pod
metadata:
  name: registry-checker
  namespace: registry-checker
  labels:
    app.kubernetes.io/name: registry-checker
spec:
  nodeSelector:
    node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
  containers:
    - name: registry-checker
      image: image-registry-checker-v2023.05.09
      ports:
        - containerPort: 80
 ---
apiVersion: v1
kind: Service
metadata:
  name: registry-nodeport-service
  namespace: registry-checker
spec:
  type: NodePort
  selector:
    app.kubernetes.io/name: registry-checker
  ports:
    - protocol: TCP
      port: 8080
      nodePort: 31385
      targetPort: 80

but not if a proper pod/container security context is applied,

---
apiVersion: v1
kind: Pod
metadata:
  name: registry-checker
  namespace: registry-checker
  labels:
    app.kubernetes.io/name: registry-checker
spec:
  nodeSelector:
    node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
  securityContext:
    runAsUser: 1001
    runAsGroup: 1001
    runAsNonRoot: true
  containers:
    - name: registry-checker
      image: image-registry-checker-v2023.05.09
      ports:
        - containerPort: 80
          protocol: TCP

which causes the following startup error,

$ microk8s kubectl logs registry-checker -n registry-checker 
 2023-05-10T09:06:38.967Z INFO  image_registry_checker > Cannot read environment from .env: path not found
thread 'main' panicked at 'error binding to 0.0.0.0:80: error creating server listener: Permission denied (os error 13)', /usr/local/cargo/registry/src/github.com-1ecc6299db9ec823/warp-0.3.3/src/server.rs:213:27
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Would it be possible to come up with an implementation that runs as non root user as well? Otherwise I probably need to fiddle with Linux capabilities. 🤔 I am not familiar with Rust, but I think the chosen socket approach is the problem.

Log reason for failed crane processes

The reason for non-zero exit codes of crane should be logged to provide more insight into the reason why looking up an image might fail. See #3 for a case in point where this might be useful.

Scan for vulnerabilities

Include scanning for vulnerabilities in the CI pipeline, e.g. using trivy.