Skip to content

refactor(Dockerfile): use ghcr.io/linkerd/proxy base image #4334

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cratelyn wants to merge 3 commits into
base: main
Choose a base branch
from
Open

refactor(Dockerfile): use ghcr.io/linkerd/proxy base image #4334

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fa55ab4
refactor(Dockerfile): use `ghcr.io/linkerd/proxy` base image
cratelyn Dec 4, 2025
90f9d41
nit: add a comment mentioning how to point to debian
cratelyn Dec 4, 2025
d20ea38
Revert "nit: add a comment mentioning how to point to debian"
cratelyn Dec 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 2 additions & 18 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,6 @@ ARG RUST_IMAGE=ghcr.io/linkerd/dev:v48-rust
# identity-initializing and linkerd-await wrappers.
ARG LINKERD2_IMAGE=ghcr.io/linkerd/proxy:edge-25.11.3

FROM $LINKERD2_IMAGE as linkerd2

FROM --platform=$BUILDPLATFORM $RUST_IMAGE as fetch

ARG PROXY_FEATURES=""
Expand Down Expand Up @@ -49,21 +47,7 @@ RUN --mount=type=cache,id=cargo,target=/usr/local/cargo/registry \
mv $(just --evaluate profile="$PROFILE" _target_bin) /out/ ; \
du -sh /out/* )

# Install the proxy binary into a base image that we can at least get a shell
# for debugging.
FROM docker.io/library/debian:bookworm-slim as runtime

RUN apt-get update && \
apt-get install -y iptables libcap2-bin && \
rm -rf /var/lib/apt/lists/*

WORKDIR /linkerd
COPY --from=linkerd2 /usr/lib/linkerd/* /usr/lib/linkerd/
# Install the proxy binary into the proxy image.
FROM $LINKERD2_IMAGE as linkerd2
COPY --from=build /out/* /usr/lib/linkerd/

USER root
RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/sbin/xtables-legacy-multi"]
RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/sbin/xtables-nft-multi"]
RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/lib/linkerd/linkerd2-proxy-init"]

Comment on lines -52 to -68
Copy link
Member Author

@cratelyn cratelyn Dec 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@adleong, i've backed out of that debian:bookworm-slim recommendation. if you have time to take another look, we now have a very slim and focused dockerfile that uses the ghcr.io/linkerd/proxy image directly.

thanks again for this idea, i think it turned out very nicely.

ENTRYPOINT ["/usr/lib/linkerd/linkerd2-proxy-identity"]