From d2d6ff33e1226c03d8131e211c02c511a9e7fc7e Mon Sep 17 00:00:00 2001 From: Ronny Trommer Date: Mon, 6 Jul 2026 21:23:50 +0200 Subject: [PATCH] fix(diag): install gnmic from a pinned release instead of curl|bash MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The diag image installed gnmic via `bash -c "$(curl -sL https://get-gnmic.openconfig.net)"`, which pulls and executes a remote script fetching the latest release at build time. That made the build non-deterministic and network-flaky — it failed intermittently in CI. Pin GNMIC_VERSION and fetch the release tarball with ADD, extracting the binary in the root RUN layer, matching how tini/ngrok/ping are handled. Assisted-by: ClaudeCode:claude-opus-4-8 Signed-off-by: Ronny Trommer --- diag/Dockerfile.tpl | 6 +++--- diag/version-lock.sh | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/diag/Dockerfile.tpl b/diag/Dockerfile.tpl index b212be0..6a34ee2 100644 --- a/diag/Dockerfile.tpl +++ b/diag/Dockerfile.tpl @@ -7,6 +7,7 @@ FROM "${BASE_IMAGE}" ADD https://github.com/krallin/tini/releases/download/v0.19.0/tini-amd64 /bin/tini ADD https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3-stable-linux-amd64.tgz /tmp/ngrok.tgz ADD https://github.com/prometheus-community/pro-bing/releases/download/v0.3.0/ping_0.3.0_linux_amd64.tar.gz /tmp/ping.tar.gz +ADD https://github.com/openconfig/gnmic/releases/download/v${GNMIC_VERSION}/gnmic_${GNMIC_VERSION}_Linux_x86_64.tar.gz /tmp/gnmic.tar.gz ENV DEBIAN_FRONTEND=noninteractive @@ -61,7 +62,8 @@ RUN apt-get update && apt-get -y install --no-install-recommends ca-certificates tar xzf /tmp/ping.tar.gz -C /tmp --strip-components=1 && \ mv /tmp/ping /usr/bin/gping && \ tar xzf /tmp/ngrok.tgz -C /usr/bin && \ - chmod +rx /usr/bin/ngrok /bin/tini && \ + tar xzf /tmp/gnmic.tar.gz -C /usr/bin gnmic && \ + chmod +rx /usr/bin/ngrok /usr/bin/gnmic /bin/tini && \ sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended && \ chsh -s $(which zsh) @@ -75,8 +77,6 @@ RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master git clone https://github.com/zsh-users/zsh-autosuggestions /home/diaguser/.oh-my-zsh/custom/plugins/zsh-autosuggestions && \ git clone --depth=1 https://github.com/romkatv/powerlevel10k.git /home/diaguser/.oh-my-zsh/custom/themes/powerlevel10k -RUN bash -c "$(curl -sL https://get-gnmic.openconfig.net)" - WORKDIR /home/diaguser COPY --chown="10001:10001" container-fs/zshrc .zshrc diff --git a/diag/version-lock.sh b/diag/version-lock.sh index 2be0a5e..5bb05dc 100644 --- a/diag/version-lock.sh +++ b/diag/version-lock.sh @@ -7,3 +7,4 @@ export VCS_SOURCE="$(git remote get-url --push origin)" export VCS_REVISION="$(git describe --always)" export BASE_IMAGE="${OS_UBUNTU}" export CA_CERT_VERSION="20240203" +export GNMIC_VERSION="0.46.0"