Is there any way to augment to the entrypoint for an image?

[Jdban]

We have a situation where we have credentials files in a kubernetes secret, and when our container starts up, we need to run a command to copy them to a different spot in the container for use because they cannot be symlinks.

We want to incorporate this into the entrypoint via a container_image step or something, but since we're using java_image, the current entrypoint is gigantic and not something we can script in (to my knowledge). We want our new entrypoint to be something like:

entrypoint = [
"run-command.sh && old_entrypoint",
]

Is there any way to do this?

[nlopezgi]

While a bit of a runaround to get this working, (if its just about copying a file, iiuc) you could try to:

• pull your container with the file
• use container_run_and_extract (https://github.com/GoogleContainerTools/base-images-docker/blob/master/util/run.bzl) to extract the file from its current location inside the container
• use container_image (using the same base for container_run_and_extract and container_image) to put the file in the new location,
• use java_image (using as base the image produced by your container_image rule) with the default entrypoint

[Jdban]

That won't work since the file is a credentials file that we don't want to bake into our docker image.

The current plan is to include a sh script that copies a run.sh file into the image as the new entrypoint, which copies the file and then runs the java program.

The tricky part now is getting the classpath argument into the image. I found a file containing the whole classpath in the bazel-bin folder, but I'm not sure how to get that as either an environment variable to the docker image, or copy that file into the image too so it can be used in the shell script

Any tips on how to get that part working?

[nlopezgi]

Which file is the one that you found that has the data you need? If its in the bazel-bin dir it should be feasible to identify the target that produces it, and create a file dependency from the java_image to the target which should result in the file being placed under the runfiles tree inside the container.

[nlopezgi]

closing this issue as we've had no followup in quite some time. Please let me know if this is still relevant (and provide additional info) and I can reopen.

[annabfenske]

While a bit of a runaround to get this working, (if its just about copying a file, iiuc) you could try to:

• pull your container with the file
• use container_run_and_extract (https://github.com/GoogleContainerTools/base-images-docker/blob/master/util/run.bzl) to extract the file from its current location inside the container
• use container_image (using the same base for container_run_and_extract and container_image) to put the file in the new location,
• use java_image (using as base the image produced by your container_image rule) with the default entrypoint

@nlopezgi could you provide an example of what this might look like in practice? I'm trying to achieve something similar with a go_image (running a shell script before the binary to wait for dependencies to be ready) but the I'm not totally clear on how to do that.

[luxe]

I see that java_image no longer supports entrypoint. It's not clear how I could modify the existing entrypoint. I tried putting an entrypoint in the container_image which is used as the java_image's base, but this seems to be overwritten in the final java image (as seen through docker inspect).