[proposal] Use golang based cp tool rather than busybox in autoinstrumentation images. #1727

jvoravong · 2023-05-10T00:49:22Z

Updates: #1600

As mentioned in previous SIG meeting and related issues, we would like to propose a replacement to the busybox base image used in the auto-instrumentation images. More work would still have to be done, but I think we have enough here start discussions. Happy to answer questions or take improvements.

This PR Proposal:

Adds a new autoinstrumentation utils docker image and integrates it into the java image.
I would like to propose creating and using a utils image because it could make it easier for downstream releases to adopt it. I'm having to work with several instrumentation team's and releases (example java dockerfile), having a utils image could help our downstream releases.
I would prefer if we went with a go based cp implementation because most of this code base is already written in go.

…java image

pavolloffay · 2023-05-10T07:54:53Z

autoinstrumentation/utils/cp.go

+	args := os.Args[1:]
+
+	if len(args) < 2 {
+		return errors.New("Not enough arguments given.")


can we make this more user-friendly? How many arguments are expected?

Still working on this and nearly done. I did upload another commit that is unrelated to this.

pavolloffay · 2023-05-10T07:58:03Z

.github/workflows/publish-images.yaml

@@ -25,6 +25,7 @@ jobs:
          grep -v '\#' versions.txt | grep opentelemetry-collector | awk -F= '{print "OTELCOL_VERSION="$2}' >> $GITHUB_ENV
          grep -v '\#' versions.txt | grep targetallocator | awk -F= '{print "TARGETALLOCATOR_VERSION="$2}' >> $GITHUB_ENV
          grep -v '\#' versions.txt | grep operator-opamp-bridge | awk -F= '{print "OPERATOR_OPAMP_BRIDGE_VERSION="$2}' >> $GITHUB_ENV
+          grep -v '\#' versions.txt | grep autoinstrumentation-utils | awk -F= '{print "AUTO_INSTRUMENTATION_UTILS_VERSION="$2}' >> $GITHUB_ENV


I am not sure why this is needed the utils version is not need to be listed in the root versions.txt

We probably don't need this, I was doing my best trying to understand the publish logic. WiIl fix later.

pavolloffay · 2023-05-10T07:59:50Z

autoinstrumentation/utils/Dockerfile

@@ -0,0 +1,11 @@
+# This utils image is intended to be used as a base image for OpenTelemetry Operator


It's not a base image. The docker image is used just to get the tool into the base image.

Good point. After some more thought, I think we could rework this image and use it as a base image and cut down on lines of code in several areas. Checking...

I was able to get change the utils image name to cp. I was able to make it a base image which I believe makes understandability and adoptability much easier. See: autoinstrumentation/cp/Dockerfil

Related Code Changes

https://github.com/open-telemetry/opentelemetry-operator/blob/8327609d594cd14fc4ccd8cd1ecf0a56c30e08d7/autoinstrumentation/cp/Dockerfile

https://github.com/open-telemetry/opentelemetry-operator/blob/8327609d594cd14fc4ccd8cd1ecf0a56c30e08d7/autoinstrumentation/java/Dockerfile

pavolloffay · 2023-05-10T08:00:52Z

autoinstrumentation/utils/Dockerfile

Could we rename the directory to cp?

Started the changes for this, still need to add more soon.

pavolloffay · 2023-05-10T08:01:40Z

.github/workflows/publish-autoinstrumentation-utils.yaml

+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ghcr.io/open-telemetry/opentelemetry-operator/autoinstrumentation-utils


I would prefer to be more explicit here e.g. ghcr.io/open-telemetry/opentelemetry-operator/autoinstrumentation-cp

Depending on where the final code for this lives, this can vary. If we keep the cp code here in this repo, we will use the proposed name.

bryan-aguilar · 2023-05-11T16:19:12Z

autoinstrumentation/utils/Dockerfile

+# This utils image is intended to be used as a base image for OpenTelemetry Operator
+# autoinstrumentation images. The utils will allow autoinstrumentation packages to be
+# copied (via a go based cp command) from the init container to the final destination volume.
+FROM golang as utils


This Dockerfile still results in an image that is distributed with the golang base image right? What is golang built on top of? I think this would need to be a multistage build to avoid this where the last stage is FROM scratch.

You are correct. I refactored the code and it now lives in autoinstrumentation/cp/Dockerfile.
I would really like us to follow a similar pattern shown in this file whether or not the code is based off of rust or golang. This way downstream auto-instrumentation vendors don't have to worry about the implementation because it is abstracted enough for them not to care about it.
Let me know your thoughts if you have them.

Related Code Changes

https://github.com/open-telemetry/opentelemetry-operator/blob/8327609d594cd14fc4ccd8cd1ecf0a56c30e08d7/autoinstrumentation/cp/Dockerfile

https://github.com/open-telemetry/opentelemetry-operator/blob/8327609d594cd14fc4ccd8cd1ecf0a56c30e08d7/autoinstrumentation/java/Dockerfile

frzifus

Only as a reference: #1698 (comment)

…o-instrumentation to use it

jvoravong · 2023-05-24T13:26:51Z

Still finishing up the code that is being refactored from utils.go to cp.go based on the unresolved conversation above. Most of it is done, still adding support for edge cases and error checking.
Was able to make some good improvements to the Dockerfile (cp) to show how we can make our auto-instrumentation Docker files and images more extendable for downstream vendors.
I'm out sick today, so I wanted to make sure to get this update out before the next SIG meeting.

jvoravong · 2023-05-24T13:59:42Z

Attaching CVE (vulnerability info):

For my latest solution using the cp image (jvsplk/opentelemetry-operator-cp:v0.0.1) that is scratch based, only 1 vulnerability was found by Trivy.
- trivy-scan-jvsplk:opentelemetry-operator-cp-v0.0.1.txt
- Related Code
  - https://github.com/open-telemetry/opentelemetry-operator/blob/8327609d594cd14fc4ccd8cd1ecf0a56c30e08d7/autoinstrumentation/cp/Dockerfile
  - https://github.com/open-telemetry/opentelemetry-operator/blob/8327609d594cd14fc4ccd8cd1ecf0a56c30e08d7/autoinstrumentation/java/Dockerfile
For my previous solution where the the utils image was golang based, 554 vulnerabilities were found by Trivy.
- trivy-scan-jvsplk:opentelemetry-operator-utils-v0.0.1.txt
- Related Code
  - https://github.com/open-telemetry/opentelemetry-operator/blob/ae719e0e47c78c9e8c7b110d6d9b112833637749/autoinstrumentation/utils/Dockerfile
  - https://github.com/open-telemetry/opentelemetry-operator/blob/ae719e0e47c78c9e8c7b110d6d9b112833637749/autoinstrumentation/java/Dockerfile

pavolloffay · 2023-06-30T14:48:08Z

@jvoravong what is the status of this PR?

jvoravong · 2024-01-18T17:06:08Z

I haven't been able to commit more time to this work. Going to close this PR for now. Will open a new PR in the future if I can work on it later.

Add autoinstrumentation utils docker image and integrate it into the …

ae719e0

…java image

jvoravong requested a review from a team as a code owner May 10, 2023 00:49

pavolloffay reviewed May 10, 2023

View reviewed changes

bryan-aguilar reviewed May 11, 2023

View reviewed changes

frzifus reviewed May 11, 2023

View reviewed changes

jvoravong added 2 commits May 24, 2023 07:14

Refactor customizable util image to slim cp image and update java aut…

8327609

…o-instrumentation to use it

Remove some utils code that was refactored to be cp code

7fb4930

jvoravong mentioned this pull request May 24, 2023

BusyBox Licensing #1600

Open

jvoravong closed this Jan 18, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[proposal] Use golang based cp tool rather than busybox in autoinstrumentation images. #1727

[proposal] Use golang based cp tool rather than busybox in autoinstrumentation images. #1727

jvoravong commented May 10, 2023 •

edited by pavolloffay

Loading

pavolloffay May 10, 2023

jvoravong May 24, 2023

pavolloffay May 10, 2023

jvoravong May 24, 2023

pavolloffay May 10, 2023

jvoravong May 11, 2023

jvoravong May 24, 2023 •

edited

Loading

pavolloffay May 10, 2023

jvoravong May 24, 2023

pavolloffay May 10, 2023

jvoravong May 24, 2023

bryan-aguilar May 11, 2023

jvoravong May 24, 2023 •

edited

Loading

frzifus left a comment

jvoravong commented May 24, 2023

jvoravong commented May 24, 2023 •

edited

Loading

pavolloffay commented Jun 30, 2023

jvoravong commented Jan 18, 2024

		@@ -0,0 +1,11 @@
		# This utils image is intended to be used as a base image for OpenTelemetry Operator

[proposal] Use golang based cp tool rather than busybox in autoinstrumentation images. #1727

[proposal] Use golang based cp tool rather than busybox in autoinstrumentation images. #1727

Conversation

jvoravong commented May 10, 2023 • edited by pavolloffay Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jvoravong May 24, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jvoravong May 24, 2023 • edited Loading

Choose a reason for hiding this comment

frzifus left a comment

Choose a reason for hiding this comment

jvoravong commented May 24, 2023

jvoravong commented May 24, 2023 • edited Loading

pavolloffay commented Jun 30, 2023

jvoravong commented Jan 18, 2024

jvoravong commented May 10, 2023 •

edited by pavolloffay

Loading

jvoravong May 24, 2023 •

edited

Loading

jvoravong May 24, 2023 •

edited

Loading

jvoravong commented May 24, 2023 •

edited

Loading