Dockerfile: dumb-init is installed from http without verification

[anguslees]

Is this a BUG REPORT or FEATURE REQUEST? (choose one):

If this is a BUG REPORT, please:

NGINX Ingress controller version:
gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.15

What happened:
Dockerfile contains these lines:

RUN curl -sSL -o /tmp/dumb-init.deb http://ftp.us.debian.org/debian/pool/main/d/dumb-init/dumb-init_1.2.0-1_amd64.deb && \
  dpkg -i /tmp/dumb-init.deb && \
  rm /tmp/dumb-init.deb

Note that dumb-init.deb is fetched from insecure http, with no post-download checksum/etc verification.

What you expected to happen:

I expected to see dumb-init downloaded from a secure source, ideally from the same apt repository that is used a few lines above to install diffutils.

Note that this latter requires an nginx-slim based on ubuntu zesty or newer, instead of the current xenial-based image (or it requires adding the zesty repo to apt.conf).

[aledbf]

Note that this latter requires an nginx-slim based on ubuntu zesty or newer, instead of the current xenial-based image (or it requires adding the zesty repo to apt.conf).

This is not possible because there's no deb packages for all platforms

[anguslees]

This is not possible because there's no deb packages for all platforms

I think this is telling me that there is support across all ubuntu platforms in zesty (and newer).

(Alternatively, perhaps we should switch nginx-slim to Debian (using minideb?) if Ubuntu has poor support for our required architectures/packages. Disclaimer: I'm a Debian Developer, so biased in favour of using the real thing ;)

[komapa]

You could alternatively switch to tini which has prebuilt packages for most platforms: https://github.com/krallin/tini/releases

[aledbf]

I think this is telling me that there is support across all ubuntu platforms in zesty (and newer).

Thank you for this.

[aledbf]

You could alternatively switch to tini which has prebuilt packages for most platforms:

We used tini in the past but we found issues reaping the nginx child processes.