opm tool generates index images based on alpine instead of from scratch

[skattoju]

When running the open command with the --generate option the following is observed:

Actual:

FROM quay.io/operator-framework/upstream-opm-builder
LABEL operators.operatorframework.io.index.database.v1=/database/index.db
ADD database/index.db /database/index.db
EXPOSE 50051
ENTRYPOINT ["/bin/opm"]
CMD ["registry", "serve", "--database", "/database/index.db"]

Expected:

FROM quay.io/operator-framework/upstream-registry-builder AS builder

FROM scratch
LABEL operators.operatorframework.io.index.database.v1=./index.db
COPY database ./
COPY --from=builder /bin/opm /opm
COPY --from=builder /bin/grpc_health_probe /bin/grpc_health_probe
EXPOSE 50051
ENTRYPOINT ["/opm"]
CMD ["registry", "serve", "--database", "index.db"]

[joelanford]

By default opm generates catalog images with alpine because other tools (like operator-sdk run bundle) expect a shell to be present, e.g. to be able to execute custom entrypoint scripts to modify the database at startup.

[joelanford]

There is a new distroless-based base image available at quay.io/operator-framework/opm. It still has a built-in shell, but I would expect it to be less susceptible to vulnerabilities than upstream alpine images.

There is a PR to change the default Dockerfil generated by opm index here: #762

[skattoju]

@joelanford even the latest distroless based opm image has a couple of vulnerabilities with openssl and libssl1 (reported on august 24th) we went back to alpine as it seemed easier to update it. Where can we find the dockerfile used to build the distroless image ?

[jeloba]

@skattoju, @joelanford I filed #777 about the new CVEs in the index image.