From cedac0a6ee10a81eeb179c17b4d56b57be09e99a Mon Sep 17 00:00:00 2001 From: Slawomir Koszewski Date: Tue, 20 Oct 2026 08:40:34 +0200 Subject: [PATCH] Update IMDS Emulator base image to Google's distroless. --- docs/storage-transfer.md | 4 ++-- sts-agent/Dockerfile | 15 ++++++++++----- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/docs/storage-transfer.md b/docs/storage-transfer.md index c161a2d..7e1e2dc 100644 --- a/docs/storage-transfer.md +++ b/docs/storage-transfer.md @@ -141,11 +141,11 @@ docker compose logs imds-emulator Requests for paths that the emulator does not serve are logged with the status 404. -`imds-test` in the emulator container tests the emulator. It checks the metadata endpoints and the rejection of requests without the `Metadata-Flavor` header or with `X-Forwarded-For`. It then authenticates with the Compute Engine credentials of `google-auth` against the emulator, the same way as the agent, and checks the token with the Google token information endpoint. With `--bucket`, it also lists the objects of the bucket with the token: +`imds_test.py` in the emulator container tests the emulator. It checks the metadata endpoints and the rejection of requests without the `Metadata-Flavor` header or with `X-Forwarded-For`. It then authenticates with the Compute Engine credentials of `google-auth` against the emulator, the same way as the agent, and checks the token with the Google token information endpoint. With `--bucket`, it also lists the objects of the bucket with the token: ```bash source ../env.sh -docker compose exec imds-emulator imds-test --bucket "${BUCKET}" +docker compose exec imds-emulator /venv/bin/python3 /app/imds_test.py --bucket "${BUCKET}" ``` It prints `PASS` or `FAIL` for each check and exits with status 1 when a check fails. diff --git a/sts-agent/Dockerfile b/sts-agent/Dockerfile index 656a7bc..839cdb9 100644 --- a/sts-agent/Dockerfile +++ b/sts-agent/Dockerfile @@ -1,8 +1,13 @@ -FROM python:3.13-slim +FROM python:3.13-slim-trixie AS build -RUN pip install --no-cache-dir "google-auth[requests,cryptography]>=2.39.0" +# The interpreter path in the virtualenv must match the path in the distroless image. +RUN ln -s /usr/local/bin/python /usr/bin/python \ + && /usr/bin/python -m venv /venv \ + && /venv/bin/pip install --no-cache-dir "google-auth[requests,cryptography]>=2.39.0" -COPY imds_emulator.py /usr/local/bin/imds-emulator -COPY imds_test.py /usr/local/bin/imds-test +FROM gcr.io/distroless/python3-debian13 -CMD ["/usr/local/bin/imds-emulator"] +COPY --from=build /venv /venv +COPY imds_emulator.py imds_test.py /app/ + +ENTRYPOINT ["/venv/bin/python3", "/app/imds_emulator.py"]