mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-04 16:39:35 +08:00
24 lines
857 B
Docker
24 lines
857 B
Docker
# syntax=docker/dockerfile:1.4
|
|
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# The static sandbox binary is staged at:
|
|
# deploy/docker/.build/prebuilt-binaries/<arch>/openshell-sandbox
|
|
#
|
|
# Alpine supplies nftables and iptables for pod-namespace egress enforcement.
|
|
|
|
FROM alpine:3.22 AS supervisor
|
|
|
|
ARG TARGETARCH
|
|
|
|
# Refresh base packages too: adding firewall tools does not upgrade OpenSSL.
|
|
RUN apk upgrade --no-cache \
|
|
&& apk add --no-cache nftables iptables iptables-legacy
|
|
|
|
# Keep the binary root-owned for Podman image-volume mounts and executable by
|
|
# the Kubernetes network sidecar's non-root proxy UID.
|
|
COPY --chmod=0555 deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-sandbox /openshell-sandbox
|
|
|
|
ENTRYPOINT ["/openshell-sandbox"]
|