Skip to content

fix: proxy-init and policy-container images have been removed #4333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cratelyn merged 2 commits into from
Dec 5, 2025
Merged

fix: proxy-init and policy-container images have been removed #4333

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c374b8d
chore(Dockerfile): update `LINKERD2_IMAGE` edge version
cratelyn Dec 1, 2025
5a4bd11
fix: address upstream changes to proxy-init image
cratelyn Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ ARG RUST_IMAGE=ghcr.io/linkerd/dev:v48-rust

# Use an arbitrary ~recent edge release image to get the proxy
# identity-initializing and linkerd-await wrappers.
ARG LINKERD2_IMAGE=ghcr.io/linkerd/proxy:edge-23.11.2
ARG LINKERD2_IMAGE=ghcr.io/linkerd/proxy:edge-25.11.3

@cratelyn cratelyn Dec 4, 2025

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would pointing this at :latest be even better? this drifted more than two years out of date. luckily there was only one other breaking change to spot and fix, but i'd like for this repo to not get so far out of step with the linkerd2 repo again.

@sfleen sfleen Dec 5, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updating to latest would at least give us signal that something broke, but it would be tricky to debug and would break CI without a source PR to trace it back to.

We've run into this kind of problem enough that it makes me think we should set up something like Renovate that can do custom dependency updates like these.

@sfleen sfleen Dec 5, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's fine to leave this as a pinned version for now while we sort out better custom dependency management for cases like these


FROM $LINKERD2_IMAGE as linkerd2

Expand Down Expand Up @@ -52,7 +52,18 @@ RUN --mount=type=cache,id=cargo,target=/usr/local/cargo/registry \
# Install the proxy binary into a base image that we can at least get a shell
# for debugging.
FROM docker.io/library/debian:bookworm-slim as runtime

RUN apt-get update && \
apt-get install -y iptables libcap2-bin && \
rm -rf /var/lib/apt/lists/*

WORKDIR /linkerd
COPY --from=linkerd2 /usr/lib/linkerd/* /usr/lib/linkerd/
COPY --from=build /out/* /usr/lib/linkerd/

USER root
Comment thread
cratelyn marked this conversation as resolved.
RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/sbin/xtables-legacy-multi"]
RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/sbin/xtables-nft-multi"]
RUN ["/usr/sbin/setcap", "cap_net_raw,cap_net_admin+eip", "/usr/lib/linkerd/linkerd2-proxy-init"]

ENTRYPOINT ["/usr/lib/linkerd/linkerd2-proxy-identity"]
15 changes: 7 additions & 8 deletions justfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,9 +243,8 @@ action-dev-check:

linkerd-tag := env_var_or_default('LINKERD_TAG', '')
_controller-image := 'ghcr.io/linkerd/controller'
_policy-image := 'ghcr.io/linkerd/policy-controller'
_init-image := 'ghcr.io/linkerd/proxy-init'
_init-tag := 'v2.4.0'
_policy-image := 'ghcr.io/linkerd/controller'
_init-image := 'ghcr.io/linkerd/proxy'

_kubectl := 'just-k3d kubectl'
_linkerd := 'linkerd --context=k3d-$(just-k3d --evaluate K3D_CLUSTER_NAME)'
Expand All @@ -270,15 +269,15 @@ k3d-load-linkerd: _tag-set _k3d-ready
for i in \
'{{ _controller-image }}:{{ linkerd-tag }}' \
'{{ _policy-image }}:{{ linkerd-tag }}' \
'{{ _init-image }}:{{ _init-tag }}' \
'{{ _init-image }}:{{ linkerd-tag }}' \
; do \
docker pull -q "$i" ; \
done
@just-k3d import \
'{{ docker-image }}' \
'{{ _controller-image }}:{{ linkerd-tag }}' \
'{{ _policy-image }}:{{ linkerd-tag }}' \
'{{ _init-image }}:{{ _init-tag }}'
'{{ _init-image }}:{{ linkerd-tag }}'

# Install crds on the test cluster.
_linkerd-crds-install: _k3d-ready
Expand All @@ -297,11 +296,11 @@ linkerd-install *args='': _tag-set k3d-load-linkerd _linkerd-crds-install && _li
--set='linkerdVersion={{ linkerd-tag }}' \
--set='policyController.image.name={{ _policy-image }}' \
--set='policyController.image.version={{ linkerd-tag }}' \
--set='proxy.image.name={{ docker-repo }}' \
--set='proxy.image.version={{ docker-tag }}' \
--set='proxy.image.name={{ _init-image }}' \
--set='proxy.image.version={{ linkerd-tag }}' \
--set='proxy.logLevel=linkerd=debug\,info' \
--set='proxyInit.image.name={{ _init-image }}' \
--set='proxyInit.image.version={{ _init-tag }}' \
--set='proxyInit.image.version={{ linkerd-tag }}' \
{{ args }} \
| {{ _kubectl }} apply -f -

Expand Down