Skip to content

Ship static busybox shell in k8s-device-plugin image #1793

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rajathagasthya wants to merge 1 commit into
base: main
Choose a base branch
from
+16 −3
Open

Ship static busybox shell in k8s-device-plugin image #1793

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions deployments/container/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,11 +40,24 @@ ARG VERSION="N/A"
ARG GIT_COMMIT="unknown"
RUN make PREFIX=/artifacts cmds

FROM nvcr.io/nvidia/distroless/go:v4.0.5-dev AS application
# Build a static busybox layout: one binary plus applet symlinks (sh, rm,
# ln, sleep, cat, ...) so PATH-resolved commands in init-container wrappers
# and lifecycle hooks keep working on the non-*-dev* distroless base.
FROM debian:trixie-slim AS shell
RUN apt-get update \
&& apt-get install -y --no-install-recommends busybox-static \
&& rm -rf /var/lib/apt/lists/* \
&& mkdir /busybox \
&& cp /bin/busybox /busybox/busybox \
&& /busybox/busybox --install -s /busybox

FROM nvcr.io/nvidia/distroless/go:v4.0.5 AS application

USER 0:0
SHELL ["/busybox/sh", "-c"]
RUN ln -s /busybox/sh /bin/sh

COPY --from=shell /busybox /busybox
RUN ["/busybox/ln", "-s", "/busybox/sh", "/bin/sh"]
Copy link
Copy Markdown
Contributor

@rajatchopra rajatchopra May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It isn't quite a departure from '-dev' if we use busybox-static. Why not bash-static?
Is it because we use extensive shell utilities?

Copy link
Copy Markdown
Contributor Author

@rajathagasthya rajathagasthya May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, the deployment manifests use shell utilities (rm, cat, etc.), which we don't get if use bash-static.

The -dev images also ship busybox in the same /busybox layout, so it's not really a departure.

ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/busybox

ENV NVIDIA_DISABLE_REQUIRE="true"
ENV NVIDIA_VISIBLE_DEVICES=all
Expand Down
Loading