#Unit Tests · Neirda24/GotenbergBundle@07...

1 messages · Page 1 of 1 (latest)

gilded mauve
#

or maybe it is docker that is just refusing because not authenticated but that would be weird

torpid egret
#

I doubt they get overwritten, but I do not know if they expire

#

That said, I just successfully did docker pull on that exact composer image , so I think the problem lies elsewhere

#

My concern is, the more specific the image, the more frequently it needs manually updating a.k.a. extra maintenance

#

And failure to keep up to date could leave us exposed to security vulnerabilities

#

Hmm. That said, I expect locking us in to a specific digest leaves us exposed as is.

#

I am going to call upon the great sage for advice.

#

@tight spruce I beseech you, grace us with your divine wisdom. 🙏

#

What is general practice for runtime images?

Do you lock in to a specific digest and just accept the maintenance burden of updating it?

tight spruce
#

cc @clever cradle @rustic totem who are the sdk experts 😄

torpid egret
#

😓 Is this the sort of thing we could set Dependabot up to deal with?

tight spruce
#

so python sort of does this

torpid egret
#

Yeah I did notice they had a Dockerfile in there when I scouted about

tight spruce
#

dependabot can pick up on that

torpid egret
#

Riight... so it handle dockerfiles specifically

#

and then Python can extract from the Dockerfile

#

That seems like a sensible way to do it

#

Updating the image itself isn't really that huge a task, it's more the "You better check regularly" which opens up security to the human factor.

So I think Python SDK tactic is the way to go.

tight spruce
#

yeah! i would say hook into the dockerfile approach! i would probably:

  • extract the dockerfile parser tool into distconsts or something, so that then it can be used in the php module too (otherwise we're just duplicating)
  • then add dockerfiles for the php runtime
  • then add the dockerfile to dependabot.yml
#

all you'll need to do is make sure the automated test coverage is good, and we can merge the prs and keep it up to date for you

#

zero touch 😄

rustic totem
# torpid egret What is general practice for runtime images? Do you lock in to a specific diges...

Yeah that's basically what I do on TypeScript.

For Node it's quite simple, I update the runtime to the latest stable major release (LTS) following this table: https://nodejs.org/en/about/previous-releases, but the user can still configure a specific version if he wants too.
For Deno & Bun it has to be done manually tho, I do it whenever a user ask or if a new major release has been pushed.
Basically I try to not do it too often because version bump can create unexpected breaking changes,

I would recommand to:

  • keep a stable version on your runtime and only update when its necessary.
  • give the user the possibility to configure its image version

I can see your concerns about security vulnerabilities, that's important indeed, however we are always executing the code inside containers so we are less likely to be impacted depending on the issue.

You can also indeed go for the Dockerfile option, that's ideal if you maintain only 1 runtime (harder for TypeScript since I have 3 different one haha)

torpid egret
# rustic totem Yeah that's basically what I do on TypeScript. For Node it's quite simple, I up...

I can see your concerns about security vulnerabilities, that's important indeed, however we are always executing the code inside containers so we are less likely to be impacted depending on the issue.

That's true

You can also indeed go for the Dockerfile option, that's ideal if you maintain only 1 runtime

Composer is the de facto package manager for PHP, so I plan to keep it as 1 runtime for the foreseeable future.

For Node it's quite simple, I update the runtime to the latest stable major release (LTS) following this table: https://nodejs.org/en/about/previous-releases, but the user can still configure a specific version if he wants too.

However it would probably be good to allow a custom image with a run at your own risk warning, similar to Python

GitHub
dagger/sdk/python/runtime/discovery.go at 51b959f92be821f878ca9f445...

An open-source runtime for composable workflows. Great for AI agents and CI/CD. - dagger/dagger

rustic totem
torpid egret
#

Thank you

rustic totem
torpid egret