Aias00 commented on code in PR #7152:
URL: https://github.com/apache/shenyu/pull/7152#discussion_r4059862532
##########
shenyu-examples/shenyu-examples-http/Dockerfile:
##########
@@ -17,13 +17,21 @@
FROM eclipse-temurin:17-centos7
ENV APP_NAME shenyu-examples-http
+LABEL org.opencontainers.image.title="${APP_NAME}" \
+ org.opencontainers.image.source="https://github.com/apache/shenyu"; \
+ org.opencontainers.image.licenses="Apache-2.0"
ENV LOCAL_PATH /opt/${APP_NAME}
RUN mkdir -p ${LOCAL_PATH}
ADD target/${APP_NAME}.jar ${LOCAL_PATH}
WORKDIR ${LOCAL_PATH}
+RUN groupadd --system shenyu && \
+ useradd --system --gid shenyu --create-home --home-dir /home/shenyu shenyu
&& \
+ chown -R shenyu:shenyu ${LOCAL_PATH}
+USER shenyu
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 CMD
["sh", "-c", "kill -0 1"]
Review Comment:
`kill -0 1` asserts nothing about the application.
PID 1 is by definition the container main process, so while the container is
up this probe can never fail; it reports "the process exists", which Docker
guarantees anyway. I verified this locally (Docker 29.4.0) with the same USER +
HEALTHCHECK pattern on a busybox image:
$ docker inspect hc1 --format '{{.State.Health.Status}}'
healthy
$ docker exec hc1 sh -c 'nc -z 127.0.0.1 8189 || echo "port 8189 NOT
listening (app not ready/broken)"'
port 8189 NOT listening (app not ready/broken)
The container reports healthy while nothing is listening on the service
port, and it stays healthy through startup, a deadlock, or a refusing JVM.
That is a false signal rather than no signal, because this repository
already consumes health status: `docker compose up --wait` is being adopted as
a readiness gate (#7151 for the storage e2e scripts) and `healthcheck.sh` gates
the integrated tests. Once one of these images is pulled into a `--wait`-based
pipeline, this probe declares it ready ~30s after start regardless of what the
JVM is doing.
Please either make it a real readiness probe (the actuator health endpoint
where the image exposes one, otherwise a TCP connect against the application
port using whatever the base image provides), or drop the HEALTHCHECK line and
land only the non-root user + labels. Note that the custom-plugin image uses
`test -s /opt/shenyu-custom-plugin.jar`, which is a build-time invariant - same
tautology, different flavour.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
