search

fbonalair / traefik-crowdsec-bouncer

A http service to verify request and bounce them according to decisions made by CrowdSec.
MIT License
272 stars 22 forks source link

Distroless image has no access to wget/curl #6

Closed rkokkelk closed 2 years ago

rkokkelk commented 2 years ago

Hi,

First of all, thanks for this awesome bouncer. For which you have specified some nice health check APIs, which I was aiming to use to implement a docker HEALTHCHECK. However, because the distroless does not contain any wget or curl CMDs, it is not possible to do this.

Can a light weight wget binary be added so that a HEALTHCHECK could properly be implemented.

fbonalair commented 2 years ago

It should be fixed with #8 , docker tag v0.3.0

rkokkelk commented 2 years ago

Hi, awesome that you got it implemented pretty quickly. However I'm actually using your /api/v1/healthz API function call for the healthcheck. This API call is awesome because I can verify 2 docker containers in 1 call.

That specific API call is not handled by #8, as far as I can quickly check. If if manage to implement a very lightweight wget CLI for multi-arch images, is that something that you would add? I'm also using your containers on an ARM implementation (PI's) so multi-arch is a requirement on my end.

fbonalair commented 2 years ago

Well, I wouldn't recommend using the healthz route for healthcheck, since most orchestrator (Kubernetes, Nomad, Swarn ...) will restart the service if it's unhealthy. So you will have an infinite restart of this service but the bouncer would technically work, just the upstream service that doesn't work. If you really want that use case, I would recommend having a environment variable flag to switch from ping to healthz route.