Use ubuntu LTS base images?

[consolewitch]

It appears that currently, the argocd image is based on whatever the latest ubuntu docker image available may be. This is a good practice in a perfect world where everything is continuously deployed. Sadly we live in a far from perfect world. Wouldn't it be a better idea to build the argocd image based on an Ubuntu LTS container so that if someone has to pin to an older version, they can still pull security patches in?

I'd be happy to submit a PR with this change but I don't want to step on any toes.

[crenshaw-dev]

When you say "they can still pull security patches in," do you mean they can re-build the image (which installs security patches) and deploy that new image?

I feel like if they're going to that trouble, they could just modify the Dockerfile to point to LTS instead of latest.

But I'm not opposed to the change, if it makes life easier for people! I'm not aware of any reason Argo CD must run on the latest version instead of LTS.

[consolewitch]

We absolutely can (and have) forked the repo and we're building with the LTS base image. However, this means that we're responsible for testing the container independently just in case the container works with the latest ubuntu but doesn't work with current LTS. We don't do this yet as we haven't had time.

From a purely selfish perspective, having the base image using LTS makes our life easier. If we're the only end-users who are in need of a working pkg manager inside the repo then I'll happily just maintain a fork internally. I just figured we couldn't be the only ones.

[crenshaw-dev]

That's reasonable. There was a conversation in the contributor's meeting about this today, and I didn't hear any strong objection. If you want to open a PR (I think it should be a one-line change), folks can voice any concerns there.

[snarlysodboxer]

If using a distro, it would be nice to be able to get the latest distro security patches without having to also take on a new version of ArgoCD.

We want to upgrade to a newer ArgoCD but that's a bigger project for us, and in the meantime we'd like to get security patches, but can't because of non-LTS.

[jannfis]

We absolutely can (and have) forked the repo and we're building with the LTS base image

Just wanted to tell folks about https://github.com/argoproj/argo-cd/tree/master/test/remote, which is exactly for this use case. Run the Argo CD end-to-end tests against a live Argo CD deployed to a cluster. This way, you can ensure that your custom built images at least pass the end-to-end test suite. It's somewhat rough right now, but it can save you some time and may spend some confidence in your builds.

[alexec]

Better to not use ubunut at all. Use distroless and reduce the risk to zero

[crenshaw-dev]

That's probably a good long-term goal. I think deprecating argocd-cm plugins will make this easier. Moving Helm to a CMP should also help.

[consolewitch]

In my specific use-case that would be frustrating. My company uses the argocd image as a base and adds several additional tools. Having a package manager (regardless of which) is very valuable to us.

[crenshaw-dev]

@consolewitch those are tools to be used in config management plugins? Or are they installed for some other reason?

[consolewitch]

Better to not use ubunut at all. Use distroless and reduce the risk to zero

In general I totally agree. scratch containers are very nice.

[snarlysodboxer]

Maybe we could have both? A distroless and distro-ed?

those are tools to be used in config management plugins?

For us, it's things like meta tools for installing/building the right versions of kustomize, sops, ksops, gpg, and more. It's might be possible to build some or all of these in a different build stage and then COPY them to a distroless argo image, but not everything can be statically linked, the ksops plugin being one.

I think for some, it would be a lot easier to also have a version of the image with a package manager in it.

[manish222agr]

Hi.
Ubuntu has regular patches and regularly resolve the vulnerabilities. I want to understand how frequency we update the Ubuntu image so we have vulnerabilities resolved, or is there a way we can build ourself with new ubuntu image. How we would build and pull the argocd image in that case.

Thanks.

[jgwest]

You may be able to find an Argo CD vendor that uses a different base image fitting your requirement (but I don't know if any are using Ubuntu specifically), but if you wish to become your own Argo CD vendor and build/push/test/host it yourself: https://argo-cd.readthedocs.io/en/stable/developer-guide/running-locally/#create-and-push-docker-images