Switch container base images to bci-nano and remove tini#5346
Merged
Conversation
thardeck
force-pushed
the
switch_to_nano_image
branch
from
702d6f4 to
7655ec7
Compare
Wait for the ChartMuseum health endpoint before posting charts.
thardeck
force-pushed
the
switch_to_nano_image
branch
from
7655ec7 to
b818523
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Switches the fleet-controller and fleet-agent container images from bci-busybox to bci-nano, adding tini as PID 1 for proper signal handling and removing the log.sh wrapper. It also adjusts GitJob pod specs to preserve termination diagnostics via TerminationMessageFallbackToLogsOnError, and hardens E2E infra setup by waiting for ChartMuseum readiness before uploading charts.
Changes:
- Update both Dockerfiles to use
bci-nanoand installtini; removelog.shfrom the image build. - Update GitJob container commands to run via
tini --and useTerminationMessageFallbackToLogsOnErrorfor better failure diagnostics. - Improve E2E stability: wait for ChartMuseum health endpoint; adjust signal-handling tests to terminate pods via deletion; tweak dev Helm install script and agent chart args/command behavior.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| package/log.sh | Removes the shell-based logging wrapper (no shell in bci-nano). |
| package/Dockerfile.agent | Switches base image to bci-nano, downloads/copies tini, sets ENTRYPOINT to tini. |
| package/Dockerfile | Switches base image to bci-nano, removes copying of log.sh, uses tini entrypoint. |
| internal/cmd/controller/gitops/reconciler/gitjob.go | Runs GitJob containers under tini and uses fallback termination messages for logs on error. |
| internal/cmd/controller/gitops/reconciler/gitjob_test.go | Updates expectations for tini command and termination message policy. |
| e2e/testenv/infra/cmd/setup.go | Waits for ChartMuseum readiness; improves load balancer IP readiness handling. |
| e2e/single-cluster/signals_test.go | Changes termination mechanism to pod deletion and updates termination-state probing logic. |
| dev/setup-fleet | Changes Helm wait behavior for local dev setup. |
| charts/fleet-agent/templates/deployment.yaml | Switches from command: to args: to avoid overriding the image entrypoint. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
thardeck
force-pushed
the
switch_to_nano_image
branch
from
b818523 to
2e5957d
Compare
and drop log.sh dependency for git jobs. Run gitjob containers through tini instead of log.sh wrappers. Remove log.sh from the main image to support bci-nano which does not have a shell. Preserve gitjob error messages by using termination message fallback-to-logs for gitjob containers.
Add tini to the fleet-agent image and use it as entrypoint for stable PID 1 behavior on bci-nano.
thardeck
force-pushed
the
switch_to_nano_image
branch
from
2e5957d to
a51ce80
Compare
thardeck
force-pushed
the
switch_to_nano_image
branch
from
a51ce80 to
fc964b0
Compare
aruiz14
approved these changes
Jun 25, 2026
aruiz14
previously requested changes
Jun 25, 2026
weyfonk
approved these changes
Jun 25, 2026
thardeck
force-pushed
the
switch_to_nano_image
branch
from
fc964b0 to
480606b
Compare
thardeck
changed the title
thardeck
force-pushed
the
switch_to_nano_image
branch
from
94b09ca to
08ffda3
Compare
Go programs handle SIGTERM correctly as PID 1, and no Fleet binary spawns child processes (exec.Command is used only in test helpers). The original reason for tini on the controller was log.sh, a shell wrapper that spawned fleetcontroller as a child; log.sh was removed when the image switched to bci-nano. The agent never had tini on main. Remove the tini downloader stage from both Dockerfiles, drop the ENTRYPOINT, and change gitjob pod specs to use fleet directly as the command instead of wrapping it with tini. Add simple tests to not forget to update the helm charts in the future.
thardeck
force-pushed
the
switch_to_nano_image
branch
from
08ffda3 to
cfd0be3
Compare
weyfonk
approved these changes
Jun 25, 2026
thardeck
dismissed
aruiz14’s stale review
Alejandro is on vacation and verified the changes via phone but could not log into github from there.
Collaborator
Author
|
I have created a ticket to track this: #5407 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switch the
fleet-controllerandfleet-agentcontainer images frombci-busyboxtobci-nanoto reduce image size and CVE exposure.Both images no longer ship
tini. The controller and agent now run the Fleet binaries directly as PID 1, which keeps signal handling correct without an init wrapper. The original controller-sidetiniusage was only needed whenlog.shwas the entrypoint; that shell wrapper has been removed, and the remaining Fleet processes do not spawn child processes that require zombie reaping.Because
bci-nanohas no shell,log.shis removed. Gitjob containers now useTerminationMessageFallbackToLogsOnErrorto preserve failure diagnostics by surfacing container logs as the termination message on non-zero exit. Their commands now invokefleetdirectly instead of going throughtini --.Also wait for the ChartMuseum health endpoint before uploading charts in the E2E test environment setup to make the process more reliable.
Refers #5407