Repository navigation
feat(devservices): Use the distroless vroom image - #719
Merged
Merged
Conversation
Run ghcr.io/getsentry/vroom:nightly-distroless in devservices, matching s4s2 and the self-hosted e2e. Nothing in the devservices config runs a shell inside the container, so only the image changes. Co-Authored-By: Claude <noreply@anthropic.com>
oioki
marked this pull request as ready for review
October 8, 2026 10:03
mjq
approved these changes
Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switch the vroom container in devservices from
ghcr.io/getsentry/vroom:nightlyto:nightly-distroless, published since #715. Same idea as getsentry/snuba#7909.Unlike snuba, nothing else changes: the devservices config has no healthcheck or other command that runs a shell inside the container, so only the image tag changes. The distroless image runs as the same uid 1000, so the
/tmp/sentry-profilesbind mount behaves as before.The distroless image already runs in s4s2 (#716), and a self-hosted install with it passed a profiling smoke test (profiles ingested, then served by vroom as a single profile and a flamegraph). Locally,
:nightly-distrolessstarted with this config's environment and bind mount,/healthreturned 200, and it has no/bin/sh.Refs SEC-1098