Dockerfile.steer

# Steering-agent image for `ksail workload intercept` (#5882): a minimal Alpine
# base carrying the iptables userspace the in-cluster agent drives, plus the
# ksail binary so the injected ephemeral container can `exec ksail steer-agent`
# over the tunnel — no operator-supplied --steer-image/--steer-command needed.
#
# Alpine (not the distroless CLI base) because the steering path needs two
# runtime tools distroless lacks: `iptables` — the agent installs a NAT REDIRECT
# rule in the pod's own network namespace (see pkg/svc/mirror/steering.go) — and
# a `sleep` holder, since InjectSteer runs `sleep infinity` as the container
# command while the real agent is exec'd over the exec channel.
FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6

# iptables userspace, including the `comment` match the steering rule tags itself
# with (SteeringRuleComment). It is the only extra package the agent needs —
# busybox already provides the `sleep` holder command. The apk version is left
# unpinned (hadolint DL3018): the base is already digest-pinned above, and
# pinning a package build against Alpine's rolling repository would rot on every
# 3.21 point refresh for no supply-chain gain over the pinned base.
# hadolint ignore=DL3018
RUN apk add --no-cache iptables

# GoReleaser v2 (buildx) provides TARGETPLATFORM, e.g. linux/amd64, linux/arm64.
ARG TARGETPLATFORM

# The same ksail binary the CLI image ships, placed on PATH so the steering
# command exec'd over the tunnel is simply `ksail steer-agent …`.
COPY ${TARGETPLATFORM}/ksail /usr/local/bin/ksail

# Point the XDG state dir at a writable tmpfs. ksail links k9s's cmd package,
# whose init() prints "Fail to init k9s logs location …" to STDOUT when it cannot
# create its state dir (the default ~/.local/state is unwritable under this
# read-only-rootfs steer container). For `ksail steer-agent` STDOUT *is* the
# tunnel channel, so that banner would inject non-frame bytes and corrupt the
# steering tunnel — the intercept client rejects it as an unknown frame type.
# /dev/shm is a writable tmpfs present in every pod, so InitLogLoc succeeds and
# emits nothing.
ENV XDG_STATE_HOME=/dev/shm

ENTRYPOINT ["/usr/local/bin/ksail"]