Conversation
Use static-debian13 distroless image for full compatibility with trixie build. It also includes CA certificates, timezone data and /etc and /tmp directories. Additionally, use SHA digest for distroless image. Signed-off-by: Daniel-Ioan Dinu <daniel_dinu30@yahoo.com>
… system example - Measure root file system size using du -h - Scan for vulnerabilities using Trivy - Run in background and test connectivity and REST API health using curl Additionally, document one unresolved CVE to .trivyignore. Signed-off-by: Daniel-Ioan Dinu <daniel_dinu30@yahoo.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Added a PocketBase0.40 Go1.27 backend system example using the distroless container image
gcr.io/distroless/static-debian13, which is compatible withtrixieand provides sufficient dependencies.The
README.mdfile contains instructions for building and running the example manually, as well as the list of dependencies that are covered by the chosen distroless image:ca-certificates)tzdata)/tmpand/etcdirectoriesAutomated Testing
The second commit of this PR contains a three-stage workflow to build and test this example via Github Actions:
rootfssize (resulting in 38MB).trivyignorefor more)curlNotes
PocketBase configures SQLite to use Write-Ahead Logging (WAL) mode for performance increase. Because it needs a shared memory (
MAP_SHARED) file for this, the unikernel experienced Error 5386SQLITE_IOERR_SHMMAPdue to Unikraft's single-PVAS environment.The fix for this was to "vendor" the PocketBase source code in the Docker build and replace
journal_mode=WALwithjournal_mode=DELETEusing twosedcommands (seeDockerfilefor more).Automated testing in CI/CD can only go as far as direct responses from
curl, as the backend system is far more complex. In theREADME.mdfile, I attached the full description of how to access the "superuser" account and properly use the app at its full potential, while running as a unikernel.