dockerfile: remove busybox - #5717
Merged
carles-grafana merged 1 commit intoOct 15, 2025
Merged
Conversation
carles-grafana
requested review from
electron0zero,
ie-pham,
javiermolinar,
joe-elliott,
mapno,
mattdurham,
mdisibio,
ruslan-mikhailov,
stoewer,
yvrhdn and
zalegrala
as code owners
October 8, 2025 08:40
javiermolinar
left a comment
javiermolinar
left a comment
Contributor
There was a problem hiding this comment.
This creates friction within the community. For example:
#5558
Do we provide any guidance on how to debug Tempo issues in running containers?
carles-grafana
force-pushed
the
dockerfile_remove_busybox
branch
from
October 8, 2025 10:17
fbe3870 to
e246afb
Compare
Contributor
Author
|
It's possible to debug a distroless container using Orbstack or Docker Desktop to open a shell. For Orbstack: |
carles-grafana
force-pushed
the
dockerfile_remove_busybox
branch
from
October 10, 2025 07:45
e246afb to
66ff3ca
Compare
|
|
||
| # we need this because some docker-compose files call chown assuming there's a shell | ||
| SHELL ["/busybox/sh", "-c"] | ||
| FROM gcr.io/distroless/static-debian12:debug AS tempo-setup |
Contributor
There was a problem hiding this comment.
Why don't we use busybox base image directly? It states clearly that the goal of this stage is to create the users and groups. I had to look twice to understand why the gcr.io/distroless/static-debian12:debug was used to. It's also shorter
FROM busybox AS user-setup
RUN addgroup -g 10001 tempo && \
adduser -D -u 10001 -G tempo tempo
Contributor
Author
There was a problem hiding this comment.
The reason is that in the final stage the /etc/passwd and /etc/group is replaced by those prepared in this stage.
These files in busybox are different to the static-debian12.
I've verified it:
docker run -it busybox
/ # cat /etc/passwd
root:x:0:0:root:/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/false
bin:x:2:2:bin:/bin:/bin/false
sys:x:3:3:sys:/dev:/bin/false
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
operator:x:37:37:Operator:/var:/bin/false
nobody:x:65534:65534:nobody:/home:/bin/false
/ # exit
docker run -it gcr.io/distroless/static-debian12:debug
/ # cat /etc/passwd
root:x:0:0:root:/root:/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/sbin/nologin
nonroot:x:65532:65532:nonroot:/home/nonroot:/sbin/nologin
And in static-debian12:latest, by attaching a shell:
❯ cat /etc/passwd
root:x:0:0:root:/root:/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/sbin/nologin
nonroot:x:65532:65532:nonroot:/home/nonroot:/sbin/nologin
But it's a good question, I'll add a comment to the Dockerfile
carles-grafana
force-pushed
the
dockerfile_remove_busybox
branch
from
October 10, 2025 08:30
66ff3ca to
1d6046d
Compare
mapno
reviewed
Oct 14, 2025
| RUN ["/busybox/addgroup", "-g", "10001", "-S", "tempo"] | ||
| RUN ["/busybox/adduser", "-u", "10001", "-S", "tempo", "-G", "tempo"] | ||
| RUN ["/busybox/mkdir", "-p", "/var/tempo", "-m", "0700"] | ||
| RUN ["/busybox/chown", "-R", "tempo:tempo", "/var/tempo"] |
Contributor
There was a problem hiding this comment.
Is chown not needed with this change?
Contributor
Author
There was a problem hiding this comment.
chown is now done by the COPY instruction below
javiermolinar
approved these changes
Oct 14, 2025
mapno
approved these changes
Oct 14, 2025
To make the Tempo image more minimal, remove busybox, which had vulnerabilities recently. Update docker-compose files accordingly.
carles-grafana
force-pushed
the
dockerfile_remove_busybox
branch
from
October 14, 2025 12:20
1d6046d to
3d47596
Compare
3 tasks
zhxiaogg
pushed a commit
to zhxiaogg/tempo
that referenced
this pull request
Jun 5, 2026
To make the Tempo image more minimal, remove busybox, which had vulnerabilities recently. Update docker-compose files accordingly. (cherry picked from commit bb678d3)
zhxiaogg
added a commit
that referenced
this pull request
Jun 5, 2026
mattdurham
pushed a commit
to mattdurham/tempo
that referenced
this pull request
Jun 18, 2026
To make the Tempo image more minimal, remove busybox, which had vulnerabilities recently. Update docker-compose files accordingly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does:
Months ago, when we switched to distroless images we decided to use the "debug" version, which includes busybox, which could help for debugging purposes.
However, recently busybox had vulnerabilities and the 2.8.2 image is affected.
I propose to remove it to make the image even more minimal and prevent future vulnerabilities. Updated docker-compose files accordingly.
Which issue(s) this PR fixes:
Fixes #
Checklist
CHANGELOG.mdupdated - the order of entries should be[CHANGE],[FEATURE],[ENHANCEMENT],[BUGFIX]