fix(packaging): Reduce docker image size by setting the permission bits in the builder stage (#21902)
fix(packaging): Reduce docker image size Using chmod/chown command with a "RUN" instruction to set the permission/ownership would bloat the image significantly, so we set the permission bits in the builder stage and then copy the files with the correct ownership.
Func committed
Apr 29, 2026 at 20:18 UTC
62054a23456106da7aa5049f1057b349d80b1559
1 file changed
+49
-24
packaging/docker/Dockerfile
+49
-24
@@ -24,7 +24,9 @@ ARG BUILD_ARCH
24
ENV BUILD_ARCH=$BUILD_ARCH
25
26
# Copy source
27
-COPY . /opt/netdata.git
27
+COPY --exclude='**/.git' \
28
+ --exclude='**/Dockerfile' \
29
+ . /opt/netdata.git
30
WORKDIR /opt/netdata.git
31
32
# Install from source
@@ -66,7 +68,29 @@ RUN mkdir -p /app/usr/sbin/ \
68
mkdir -p /deps/etc && \
69
cp -rp /deps/etc /app/usr/local/etc && \
70
chmod -R o+rX /app && \
69
- chmod +x /app/usr/sbin/run.sh
71
+ chmod +x /app/usr/sbin/run.sh && \
72
+ # Apply the permissions per https://learn.netdata.cloud/docs/collecting-metrics#file-permissions-and-ownership
73
+ # TODO: "5" is used for the "others" bit, not consistent with the documentation
74
+ chmod 0755 /app/usr/libexec/netdata/plugins.d/*.plugin && \
75
+ for name in cgroup-network \
76
+ local-listeners \
77
+ apps.plugin \
78
+ debugfs.plugin \
79
+ freeipmi.plugin \
80
+ go.d.plugin \
81
+ perf.plugin \
82
+ ndsudo \
83
+ slabinfo.plugin \
84
+ network-viewer.plugin \
85
+ otel-plugin \
86
+ otel-signal-viewer-plugin \
87
+ systemd-journal.plugin; do \
88
+ [ -f "/app/usr/libexec/netdata/plugins.d/$name" ] && chmod 4755 "/app/usr/libexec/netdata/plugins.d/$name"; \
89
+ done && \
90
+ # Group write permissions due to: https://github.com/netdata/netdata/pull/6543
91
+ find /app/var/lib/netdata /app/var/cache/netdata -type d -exec chmod 0770 {} \; && \
92
+ find /app/var/lib/netdata /app/var/cache/netdata -type f -exec chmod 0660 {} \; && \
93
+ chmod 0700 /app/var/lib/netdata/cloud.d
94
95
#####################################################################
96
# This image contains preinstalled dependencies
@@ -108,27 +132,31 @@ RUN mkdir -p /opt/src /var/log/netdata && \
132
ln -sf /dev/stderr /var/log/netdata/error.log && \
133
ln -sf /dev/stderr /var/log/netdata/daemon.log && \
134
ln -sf /dev/stdout /var/log/netdata/collector.log && \
111
- ln -sf /dev/stdout /var/log/netdata/health.log
112
-
113
-COPY --from=builder /app /
114
-
115
-# Create netdata user and apply the permissions as described in
116
-# https://docs.netdata.cloud/docs/netdata-security/#netdata-directories, but own everything by root group due to https://github.com/netdata/netdata/pull/6543
135
+ ln -sf /dev/stdout /var/log/netdata/health.log && \
136
+ chown -R ${NETDATA_UID}:0 /var/log/netdata
137
+
138
+# Using chmod/chown command with a "RUN" instruction to set the permission/ownership
139
+# would bloat the image significantly, so we set the permission bits in the builder stage
140
+# and then copy the files with the correct ownership.
141
+# Own everything by root group due to https://github.com/netdata/netdata/pull/6543
142
+COPY --from=builder --chown=0:0 --parents \
143
+ /app/./usr/sbin/ \
144
+ /app/./usr/share/netdata \
145
+ /app/./usr/libexec/netdata \
146
+ /app/./usr/local/etc \
147
+ /app/./etc/netdata \
148
+ /
149
+COPY --from=builder --chown=${NETDATA_UID}:0 --parents \
150
+ /app/./usr/lib/netdata \
151
+ /app/./var/cache/netdata \
152
+ /app/./var/lib/netdata \
153
+ /
154
+
155
+# Create netdata user
156
# hadolint ignore=DL3013
157
RUN addgroup --gid ${NETDATA_GID} --system "${DOCKER_GRP}" && \
158
adduser --system --no-create-home --shell /usr/sbin/nologin --uid ${NETDATA_UID} --home /etc/netdata --group "${DOCKER_USR}" && \
120
- chown -R root:root \
121
- /etc/netdata \
122
- /usr/share/netdata \
123
- /usr/libexec/netdata && \
124
- chown -R netdata:root \
125
- /usr/lib/netdata \
126
- /var/cache/netdata \
127
- /var/lib/netdata \
128
- /var/log/netdata && \
129
- chown -R netdata:netdata /var/lib/netdata/cloud.d && \
130
- chmod 0700 /var/lib/netdata/cloud.d && \
131
- chmod 0755 /usr/libexec/netdata/plugins.d/*.plugin && \
159
+ chown -R ${NETDATA_UID}:${NETDATA_GID} /var/lib/netdata/cloud.d && \
160
for name in cgroup-network \
161
local-listeners \
162
apps.plugin \
@@ -142,11 +170,8 @@ RUN addgroup --gid ${NETDATA_GID} --system "${DOCKER_GRP}" && \
170
otel-plugin \
171
otel-signal-viewer-plugin \
172
systemd-journal.plugin; do \
145
- [ -f "/usr/libexec/netdata/plugins.d/$name" ] && chmod 4755 "/usr/libexec/netdata/plugins.d/$name"; \
173
+ [ -f "/usr/libexec/netdata/plugins.d/$name" ] && test $(stat -c %a "/usr/libexec/netdata/plugins.d/$name") = "4755"; \
174
done && \
147
- # Group write permissions due to: https://github.com/netdata/netdata/pull/6543
148
- find /var/lib/netdata /var/cache/netdata -type d -exec chmod 0770 {} \; && \
149
- find /var/lib/netdata /var/cache/netdata -type f -exec chmod 0660 {} \; && \
175
cp -va /etc/netdata /etc/netdata.stock
176
177
ENTRYPOINT ["/usr/sbin/run.sh"]