slawek/gcp-wif-test
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update IMDS Emulator base image to Google's distroless.

Browse Source
This commit is contained in:
slawek committed 2026-10-20 08:40:34 +02:00
1 parent 1dd1f4043b
commit cedac0a6ee
2 files changed
+12 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/storage-transfer.md
+2 -2
View File
@@ -141,11 +141,11 @@ docker compose logs imds-emulator
Requests for paths that the emulator does not serve are logged with the status 404. Requests for paths that the emulator does not serve are logged with the status 404.
`imds-test` in the emulator container tests the emulator. It checks the metadata endpoints and the rejection of requests without the `Metadata-Flavor` header or with `X-Forwarded-For`. It then authenticates with the Compute Engine credentials of `google-auth` against the emulator, the same way as the agent, and checks the token with the Google token information endpoint. With `--bucket`, it also lists the objects of the bucket with the token: `imds_test.py` in the emulator container tests the emulator. It checks the metadata endpoints and the rejection of requests without the `Metadata-Flavor` header or with `X-Forwarded-For`. It then authenticates with the Compute Engine credentials of `google-auth` against the emulator, the same way as the agent, and checks the token with the Google token information endpoint. With `--bucket`, it also lists the objects of the bucket with the token:
```bash ```bash
source ../env.sh source ../env.sh
docker compose exec imds-emulator imds-test --bucket "${BUCKET}" docker compose exec imds-emulator /venv/bin/python3 /app/imds_test.py --bucket "${BUCKET}"
``` ```
It prints `PASS` or `FAIL` for each check and exits with status 1 when a check fails. It prints `PASS` or `FAIL` for each check and exits with status 1 when a check fails.
sts-agent/Dockerfile
+10 -5
View File
@@ -1,8 +1,13 @@
FROM python:3.13-slim FROM python:3.13-slim-trixie AS build
RUN pip install --no-cache-dir "google-auth[requests,cryptography]>=2.39.0" # The interpreter path in the virtualenv must match the path in the distroless image.
RUN ln -s /usr/local/bin/python /usr/bin/python \
&& /usr/bin/python -m venv /venv \
&& /venv/bin/pip install --no-cache-dir "google-auth[requests,cryptography]>=2.39.0"
COPY imds_emulator.py /usr/local/bin/imds-emulator FROM gcr.io/distroless/python3-debian13
COPY imds_test.py /usr/local/bin/imds-test
CMD ["/usr/local/bin/imds-emulator"] COPY --from=build /venv /venv
COPY imds_emulator.py imds_test.py /app/
ENTRYPOINT ["/venv/bin/python3", "/app/imds_emulator.py"]