Skip to content

Ensure run-image stack matches builder in Cloud Build #400

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
davideme merged 5 commits into from
Feb 20, 2026
Merged

Ensure run-image stack matches builder in Cloud Build #400

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
353ebf1
Add root run Dockerfile
davideme Feb 20, 2026
2f95294
chore(java): add original cloudbuild config
davideme Feb 20, 2026
211615b
build(java): use custom run image for pack build
davideme Feb 20, 2026
917e506
fix(java): align buildpack run image with google-22 stack
davideme Feb 20, 2026
0bb5dc6
merge: integrate origin/main into java run-image stack fix branch
davideme Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/java/cloudbuild.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ steps:
- build
- >-
$_AR_HOSTNAME/$_AR_PROJECT_ID/$_AR_REPOSITORY/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA
- '--builder=gcr.io/buildpacks/builder:latest'
- '--builder=gcr.io/buildpacks/builder:google-22'
- '--run-image=$_AR_HOSTNAME/$_AR_PROJECT_ID/$_AR_REPOSITORY/$REPO_NAME/java-run:latest'
- '--network=cloudbuild'
- '--path=src/java'
Expand Down
2 changes: 1 addition & 1 deletion src/java/run.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
FROM gcr.io/buildpacks/gcp/run
FROM gcr.io/buildpacks/google-22/run
USER root
Copy link

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting the container USER to root in the runtime image unnecessarily grants full privileges inside the container, increasing the impact of any code execution or container escape vulnerability. If application code or dependencies are compromised, an attacker would gain root-level control of the container, which is particularly risky in Cloud Run and other multi-tenant environments. Prefer running as the non-root user provided by gcr.io/buildpacks/google-22/run or another dedicated unprivileged user, and grant elevated capabilities only where strictly necessary.

Suggested change
USER root

Copilot uses AI. Check for mistakes.