Graham McIntire
f35be66148
The old code only tried unprivileged UDP ICMP (udp4), which relies on the ping_group_range sysctl — not CAP_NET_RAW. Docker doesn't set that sysctl, so pings always timed out and fell through to exec. Now tries raw ICMP sockets (ip4:icmp) first, which properly uses CAP_NET_RAW. Also sets cap_net_raw+ep on the agent binary in the Dockerfile.
20 lines
718 B
Docker
20 lines
718 B
Docker
FROM golang:1.25-alpine3.23 AS builder
|
|
WORKDIR /app
|
|
COPY go.mod go.sum ./
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
go mod download
|
|
COPY . .
|
|
ARG VERSION=dev
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
CGO_ENABLED=0 go build -ldflags="-s -w -X main.version=${VERSION}" -o towerops-agent .
|
|
|
|
FROM alpine:3.23
|
|
RUN apk add --no-cache ca-certificates iputils libcap
|
|
COPY --from=builder /app/towerops-agent /usr/local/bin/towerops-agent
|
|
RUN adduser -D -u 1000 towerops && \
|
|
chown towerops /usr/local/bin/towerops-agent && \
|
|
setcap cap_net_raw+ep /usr/local/bin/towerops-agent && \
|
|
setcap cap_net_raw+p /bin/ping
|
|
USER towerops
|
|
CMD ["towerops-agent"]
|