From c374b8d8cdd941a1cbbe0ffc4bda85058ea40642 Mon Sep 17 00:00:00 2001 From: katelyn martin Date: Mon, 1 Dec 2025 00:00:00 +0000 Subject: [PATCH 1/2] chore(Dockerfile): update `LINKERD2_IMAGE` edge version Signed-off-by: katelyn martin --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index b5ca2b37d1..f6b92ad7f1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,7 +7,7 @@ ARG RUST_IMAGE=ghcr.io/linkerd/dev:v48-rust # Use an arbitrary ~recent edge release image to get the proxy # identity-initializing and linkerd-await wrappers. -ARG LINKERD2_IMAGE=ghcr.io/linkerd/proxy:edge-23.11.2 +ARG LINKERD2_IMAGE=ghcr.io/linkerd/proxy:edge-25.11.3 FROM $LINKERD2_IMAGE as linkerd2 From 5a4bd11e579f2a4bc3ad7b898398fae300d172fb Mon Sep 17 00:00:00 2001 From: katelyn martin Date: Thu, 4 Dec 2025 00:00:00 +0000 Subject: [PATCH 2/2] fix: address upstream changes to proxy-init image Signed-off-by: katelyn martin --- Dockerfile | 11 +++++++++++ justfile | 15 +++++++-------- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/Dockerfile b/Dockerfile index f6b92ad7f1..a8242c3bc7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -52,7 +52,18 @@ RUN --mount=type=cache,id=cargo,target=/usr/local/cargo/registry \ # Install the proxy binary into a base image that we can at least get a shell # for debugging. FROM docker.io/library/debian:bookworm-slim as runtime + +RUN apt-get update && \ + apt-get install -y iptables libcap2-bin && \ + rm -rf /var/lib/apt/lists/* + WORKDIR /linkerd COPY --from=linkerd2 /usr/lib/linkerd/* /usr/lib/linkerd/ COPY --from=build /out/* /usr/lib/linkerd/ + +USER root +RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/sbin/xtables-legacy-multi"] +RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/sbin/xtables-nft-multi"] +RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/lib/linkerd/linkerd2-proxy-init"] + ENTRYPOINT ["/usr/lib/linkerd/linkerd2-proxy-identity"] diff --git a/justfile b/justfile index 24015333ec..3e049b60d9 100644 --- a/justfile +++ b/justfile @@ -243,9 +243,8 @@ action-dev-check: linkerd-tag := env_var_or_default('LINKERD_TAG', '') _controller-image := 'ghcr.io/linkerd/controller' -_policy-image := 'ghcr.io/linkerd/policy-controller' -_init-image := 'ghcr.io/linkerd/proxy-init' -_init-tag := 'v2.4.0' +_policy-image := 'ghcr.io/linkerd/controller' +_init-image := 'ghcr.io/linkerd/proxy' _kubectl := 'just-k3d kubectl' _linkerd := 'linkerd --context=k3d-$(just-k3d --evaluate K3D_CLUSTER_NAME)' @@ -270,7 +269,7 @@ k3d-load-linkerd: _tag-set _k3d-ready for i in \ '{{ _controller-image }}:{{ linkerd-tag }}' \ '{{ _policy-image }}:{{ linkerd-tag }}' \ - '{{ _init-image }}:{{ _init-tag }}' \ + '{{ _init-image }}:{{ linkerd-tag }}' \ ; do \ docker pull -q "$i" ; \ done @@ -278,7 +277,7 @@ k3d-load-linkerd: _tag-set _k3d-ready '{{ docker-image }}' \ '{{ _controller-image }}:{{ linkerd-tag }}' \ '{{ _policy-image }}:{{ linkerd-tag }}' \ - '{{ _init-image }}:{{ _init-tag }}' + '{{ _init-image }}:{{ linkerd-tag }}' # Install crds on the test cluster. _linkerd-crds-install: _k3d-ready @@ -297,11 +296,11 @@ linkerd-install *args='': _tag-set k3d-load-linkerd _linkerd-crds-install && _li --set='linkerdVersion={{ linkerd-tag }}' \ --set='policyController.image.name={{ _policy-image }}' \ --set='policyController.image.version={{ linkerd-tag }}' \ - --set='proxy.image.name={{ docker-repo }}' \ - --set='proxy.image.version={{ docker-tag }}' \ + --set='proxy.image.name={{ _init-image }}' \ + --set='proxy.image.version={{ linkerd-tag }}' \ --set='proxy.logLevel=linkerd=debug\,info' \ --set='proxyInit.image.name={{ _init-image }}' \ - --set='proxyInit.image.version={{ _init-tag }}' \ + --set='proxyInit.image.version={{ linkerd-tag }}' \ {{ args }} \ | {{ _kubectl }} apply -f -