slawek/gcp-wif-test
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update IMDS Emulator base image to Google's distroless.

Browse Source
This commit is contained in:
slawek committed 2026-10-20 08:40:34 +02:00
1 parent 1dd1f4043b
commit cedac0a6ee
2 files changed
+12 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/storage-transfer.md
+2 -2
View File
@@ -141,11 +141,11 @@ docker compose logs imds-emulator
Requests for paths that the emulator does not serve are logged with the status 404.
`imds-test` in the emulator container tests the emulator. It checks the metadata endpoints and the rejection of requests without the `Metadata-Flavor` header or with `X-Forwarded-For`. It then authenticates with the Compute Engine credentials of `google-auth` against the emulator, the same way as the agent, and checks the token with the Google token information endpoint. With `--bucket`, it also lists the objects of the bucket with the token:
`imds_test.py` in the emulator container tests the emulator. It checks the metadata endpoints and the rejection of requests without the `Metadata-Flavor` header or with `X-Forwarded-For`. It then authenticates with the Compute Engine credentials of `google-auth` against the emulator, the same way as the agent, and checks the token with the Google token information endpoint. With `--bucket`, it also lists the objects of the bucket with the token:
```bash
source ../env.sh
docker compose exec imds-emulator imds-test --bucket "${BUCKET}"
docker compose exec imds-emulator /venv/bin/python3 /app/imds_test.py --bucket "${BUCKET}"
```
It prints `PASS` or `FAIL` for each check and exits with status 1 when a check fails.
sts-agent/Dockerfile
+10 -5
View File
@@ -1,8 +1,13 @@
FROM python:3.13-slim
FROM python:3.13-slim-trixie AS build
RUN pip install --no-cache-dir "google-auth[requests,cryptography]>=2.39.0"
# The interpreter path in the virtualenv must match the path in the distroless image.
RUN ln -s /usr/local/bin/python /usr/bin/python \
&& /usr/bin/python -m venv /venv \
&& /venv/bin/pip install --no-cache-dir "google-auth[requests,cryptography]>=2.39.0"
COPY imds_emulator.py /usr/local/bin/imds-emulator
COPY imds_test.py /usr/local/bin/imds-test
FROM gcr.io/distroless/python3-debian13
CMD ["/usr/local/bin/imds-emulator"]
COPY --from=build /venv /venv
COPY imds_emulator.py imds_test.py /app/
ENTRYPOINT ["/venv/bin/python3", "/app/imds_emulator.py"]