Replace private ECR images with public Docker Hub images - #42
Conversation
Updated README to reflect project changes and added tech stack.
Added screenshots to the README for better visualization.
Updated the container image for the API from the ECR backend image to the Node.js 18 Alpine image.
📝 WalkthroughWalkthroughThe API and frontend deployments now use public container images. Existing runtime settings remain unchanged. The README now documents the fork, deployment work, architecture, Kubernetes concepts, screenshots, and technology stack. ChangesDeployment and documentation
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (3)
Kubernetes-Manifests-file/Backend/deployment.yaml (2)
28-28: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winRemove the ECR pull secret from both public-image Deployments.
Kubernetes documents that public image pulls need no registry secret. A missing referenced Secret produces
FailedToRetrieveImagePullSecretwarnings and keeps the manifests coupled to the old AWS setup. (kubernetes.io)
- Kubernetes-Manifests-file/Backend/deployment.yaml#L28-L28: Remove
ecr-registry-secretunless Docker Hub authentication is intentionally required.- Kubernetes-Manifests-file/Frontend/deployment.yaml#L28-L28: Remove the same obsolete ECR secret reference.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Kubernetes-Manifests-file/Backend/deployment.yaml` at line 28, Remove the obsolete ecr-registry-secret imagePullSecrets reference from both public-image Deployments: Kubernetes-Manifests-file/Backend/deployment.yaml lines 28-28 and Kubernetes-Manifests-file/Frontend/deployment.yaml lines 28-28. Leave the public image configuration unchanged and do not add a replacement registry secret.
28-28: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin both public images to immutable digests.
The current tag-based references can resolve to different contents over time, especially with
imagePullPolicy: Always. Docker recommends digest references for reproducible image contents. (docs.docker.com)
- Kubernetes-Manifests-file/Backend/deployment.yaml#L28-L28: Pin the final backend application image to a tested version and digest.
- Kubernetes-Manifests-file/Frontend/deployment.yaml#L28-L29: Replace
nginx:latestwith the tested frontend image version and digest.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Kubernetes-Manifests-file/Backend/deployment.yaml` at line 28, Pin both deployment container images to tested immutable digests: update Kubernetes-Manifests-file/Backend/deployment.yaml lines 28-28 from the tag-based Node image to the final tested backend image and digest, and update Kubernetes-Manifests-file/Frontend/deployment.yaml lines 28-29 from nginx:latest to the tested frontend image version and digest.README.md (1)
55-75: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRestore reproducible deployment steps.
This section lists deployment outcomes and Kubernetes concepts, but it does not provide prerequisites, Secret creation,
kubectl applycommands, apply order, endpoint verification, or cleanup. Since the previous setup and deployment sections were removed, add a short procedure for deploying without AWS access.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` around lines 55 - 75, Expand the README deployment documentation around “What I Did” and “Architecture” with a concise, reproducible local Kubernetes procedure: list prerequisites, show Secret creation, provide the required kubectl apply commands in dependency order, explain endpoint verification, and include cleanup commands. Ensure the steps work without AWS access and retain the existing outcomes and concepts sections.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Kubernetes-Manifests-file/Backend/deployment.yaml`:
- Line 28: The backend Deployment at
Kubernetes-Manifests-file/Backend/deployment.yaml:28 must reference a public
application image built from Application-Code/backend/Dockerfile, preserving
node index.js and port 3500. Update the frontend Deployment at
Kubernetes-Manifests-file/Frontend/deployment.yaml:28-34 to use a public image
containing the React bundle and align its nginx or application port with the
corresponding Service.
- Line 28: Update Kubernetes-Manifests-file/Backend/deployment.yaml lines 28-28
by using an application image that runs as a non-root UID and adding Pod
securityContext settings for allowPrivilegeEscalation: false, runAsNonRoot:
true, and dropped capabilities. Update
Kubernetes-Manifests-file/Frontend/deployment.yaml lines 28-28 to use an
unprivileged nginx image or compatible configuration, apply the same
restrictions, and preserve required port and filesystem access.
- Line 28: Update Jenkins-Pipeline-Code/Jenkinsfile-Backend to publish, rewrite,
and scan the public backend application image matching the backend deployment
reference at Kubernetes-Manifests-file/Backend/deployment.yaml:28-28. Update
Jenkins-Pipeline-Code/Jenkinsfile-Frontend similarly for the public frontend
image matching Kubernetes-Manifests-file/Frontend/deployment.yaml:28-28,
preserving the existing backend: and frontend: parsing contract so CI updates
and scans the deployed images.
- Line 28: Add a pod/container security context to the Deployment using
allowPrivilegeEscalation: false, runAsNonRoot: true, and drop all Linux
capabilities. Configure any required writable paths, such as temporary or
application directories, so the container continues operating without root
privileges.
In `@README.md`:
- Line 51: Update the README metadata date in the “forked repo : abhiMahata”
entry and the related screenshot names around the referenced section from August
13, 2026 to the actual review date, August 12, 2026, using an unambiguous date
format where displayed.
---
Nitpick comments:
In `@Kubernetes-Manifests-file/Backend/deployment.yaml`:
- Line 28: Remove the obsolete ecr-registry-secret imagePullSecrets reference
from both public-image Deployments:
Kubernetes-Manifests-file/Backend/deployment.yaml lines 28-28 and
Kubernetes-Manifests-file/Frontend/deployment.yaml lines 28-28. Leave the public
image configuration unchanged and do not add a replacement registry secret.
- Line 28: Pin both deployment container images to tested immutable digests:
update Kubernetes-Manifests-file/Backend/deployment.yaml lines 28-28 from the
tag-based Node image to the final tested backend image and digest, and update
Kubernetes-Manifests-file/Frontend/deployment.yaml lines 28-29 from nginx:latest
to the tested frontend image version and digest.
In `@README.md`:
- Around line 55-75: Expand the README deployment documentation around “What I
Did” and “Architecture” with a concise, reproducible local Kubernetes procedure:
list prerequisites, show Secret creation, provide the required kubectl apply
commands in dependency order, explain endpoint verification, and include cleanup
commands. Ensure the steps work without AWS access and retain the existing
outcomes and concepts sections.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7058cb55-6c66-4c83-a9c0-86323461f254
📒 Files selected for processing (3)
Kubernetes-Manifests-file/Backend/deployment.yamlKubernetes-Manifests-file/Frontend/deployment.yamlREADME.md
| containers: | ||
| - name: api | ||
| image: 407622020962.dkr.ecr.us-east-1.amazonaws.com/backend:latest | ||
| image: node:18-alpine |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | 🏗️ Heavy lift
Use application images in both Deployments.
The repository Dockerfiles define application-specific build and start contracts. The new stock images do not contain those application artifacts. The backend loses its source and dependencies. The frontend loses its React bundle and uses a different listener port. The official image documentation supports deriving application images from these base images. (github.com)
- Kubernetes-Manifests-file/Backend/deployment.yaml#L28-L28: Reference a public image built from
Application-Code/backend/Dockerfile, preservingnode index.jsand port 3500. - Kubernetes-Manifests-file/Frontend/deployment.yaml#L28-L34: Reference a public image containing the React bundle, and align nginx or application ports with the Service.
📍 Affects 2 files
Kubernetes-Manifests-file/Backend/deployment.yaml#L28-L28(this comment)Kubernetes-Manifests-file/Frontend/deployment.yaml#L28-L34
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Kubernetes-Manifests-file/Backend/deployment.yaml` at line 28, The backend
Deployment at Kubernetes-Manifests-file/Backend/deployment.yaml:28 must
reference a public application image built from
Application-Code/backend/Dockerfile, preserving node index.js and port 3500.
Update the frontend Deployment at
Kubernetes-Manifests-file/Frontend/deployment.yaml:28-34 to use a public image
containing the React bundle and align its nginx or application port with the
corresponding Service.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Add explicit non-root controls to both Pod templates.
Checkov reports CKV_K8S_20 and CKV_K8S_23 for both Deployments. The selected application images must support non-root execution and restricted privilege escalation.
- Kubernetes-Manifests-file/Backend/deployment.yaml#L28-L28: Build the backend image for a non-root UID and set
allowPrivilegeEscalation: false,runAsNonRoot: true, and dropped capabilities. - Kubernetes-Manifests-file/Frontend/deployment.yaml#L28-L28: Use an unprivileged nginx image or configuration, then apply the same security restrictions without breaking port or filesystem access.
📍 Affects 2 files
Kubernetes-Manifests-file/Backend/deployment.yaml#L28-L28(this comment)Kubernetes-Manifests-file/Frontend/deployment.yaml#L28-L28
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Kubernetes-Manifests-file/Backend/deployment.yaml` at line 28, Update
Kubernetes-Manifests-file/Backend/deployment.yaml lines 28-28 by using an
application image that runs as a non-root UID and adding Pod securityContext
settings for allowPrivilegeEscalation: false, runAsNonRoot: true, and dropped
capabilities. Update Kubernetes-Manifests-file/Frontend/deployment.yaml lines
28-28 to use an unprivileged nginx image or compatible configuration, apply the
same restrictions, and preserve required port and filesystem access.
Source: Linters/SAST tools
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Align both Deployments with the CI image contract.
Both Jenkins pipelines still build, push, rewrite, and scan ECR image names. The manifests now reference public images that do not match the pipelines' backend: and frontend: parsing logic. CI can therefore update the wrong resource and scan an image that is not deployed.
- Kubernetes-Manifests-file/Backend/deployment.yaml#L28-L28: Update
Jenkins-Pipeline-Code/Jenkinsfile-Backendto publish, update, and scan the public backend application image. - Kubernetes-Manifests-file/Frontend/deployment.yaml#L28-L28: Update
Jenkins-Pipeline-Code/Jenkinsfile-Frontendto publish, update, and scan the public frontend application image.
📍 Affects 2 files
Kubernetes-Manifests-file/Backend/deployment.yaml#L28-L28(this comment)Kubernetes-Manifests-file/Frontend/deployment.yaml#L28-L28
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Kubernetes-Manifests-file/Backend/deployment.yaml` at line 28, Update
Jenkins-Pipeline-Code/Jenkinsfile-Backend to publish, rewrite, and scan the
public backend application image matching the backend deployment reference at
Kubernetes-Manifests-file/Backend/deployment.yaml:28-28. Update
Jenkins-Pipeline-Code/Jenkinsfile-Frontend similarly for the public frontend
image matching Kubernetes-Manifests-file/Frontend/deployment.yaml:28-28,
preserving the existing backend: and frontend: parsing contract so CI updates
and scans the deployed images.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 3 'securityContext|runAsNonRoot|allowPrivilegeEscalation|capabilities' \
Kubernetes-Manifests-file/Backend/deployment.yamlRepository: LondheShubham153/TWSThreeTierAppChallenge
Length of output: 179
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- deployment.yaml ---'
cat -n Kubernetes-Manifests-file/Backend/deployment.yaml
printf '%s\n' '--- backend Dockerfiles ---'
fd -i -t f 'Dockerfile' Application-Code/backend --exec sh -c 'echo "--- $1 ---"; cat -n "$1"' sh {}
printf '%s\n' '--- image references in manifests and CI ---'
rg -n -C 3 'image:|ECR|ecr|docker|deployment|securityContext|runAsNonRoot|allowPrivilegeEscalation|capabilities' \
Kubernetes-Manifests-file/Backend Jenkins-Pipeline-Code/Jenkinsfile-Backend Application-Code/backendRepository: LondheShubham153/TWSThreeTierAppChallenge
Length of output: 8198
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
manifest = Path("Kubernetes-Manifests-file/Backend/deployment.yaml").read_text()
jenkins = Path("Jenkins-Pipeline-Code/Jenkinsfile-Backend").read_text()
dockerfile = Path("Application-Code/backend/Dockerfile").read_text()
container_block = manifest.split(" containers:", 1)[1]
container_block = container_block.split("\n env:", 1)[0]
checks = {
"manifest image": re.search(r"(?m)^\s+image:\s*(\S+)", manifest).group(1),
"container has securityContext": bool(re.search(r"(?m)^\s+securityContext:", container_block)),
"container has runAsNonRoot": bool(re.search(r"(?m)^\s+runAsNonRoot:\s*true", container_block)),
"container has allowPrivilegeEscalation false": bool(re.search(r"(?m)^\s+allowPrivilegeEscalation:\s*false", container_block)),
"container drops capabilities": bool(re.search(r"(?m)^\s+capabilities:\s*\n(?:\s+.*\n)*?\s+drop:", container_block)),
"Dockerfile starts application": 'CMD ["node", "index.js"]' in dockerfile,
"Jenkins expects backend image tag": "grep -oP '(?<=backend:)[^ ]+' deployment.yaml" in jenkins,
}
for name, value in checks.items():
print(f"{name}: {value}")
PYRepository: LondheShubham153/TWSThreeTierAppChallenge
Length of output: 445
🌐 Web query:
official node Docker image node:18-alpine Dockerfile default USER root
💡 Result:
The official Node.js Docker images, including node:18-alpine, default to the root user [1][2][3]. Although these images include a pre-configured non-privileged user named node, the images do not switch to this user by default in their Dockerfile [2][3][4]. The maintainers follow this practice to ensure maximum flexibility for users who need to perform administrative tasks (such as installing OS-level dependencies via apk) during the build process without needing to explicitly switch back and forth between users [3]. If you wish to run your application as the non-privileged node user, you must explicitly set the user in your own Dockerfile [2][4]: USER node Alternatively, you can run the container with the node user at runtime using the --user flag [5][6]: docker run -u node
Citations:
- 1: https://www.baeldung.com/linux/docker-alpine-add-user
- 2: https://kemalcodes.com/posts/devtools-docker-dockerfile/
- 3: why use root as the default user? nodejs/docker-node#1169
- 4: https://safeguard.sh/resources/blog/node-js-images
- 5: https://github.com/nodejs/docker-node/
- 6: https://github.com/nodejs/docker-node/blob/dbab8eb1810567084f4600f711b9f87fd11b3216/docs/BestPractices.md
Add an explicit non-root security context to the Deployment.
node:18-alpine runs as root by default. Set allowPrivilegeEscalation: false and runAsNonRoot: true, and drop all capabilities. Ensure required writable paths remain available.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Kubernetes-Manifests-file/Backend/deployment.yaml` at line 28, Add a
pod/container security context to the Deployment using allowPrivilegeEscalation:
false, runAsNonRoot: true, and drop all Linux capabilities. Configure any
required writable paths, such as temporary or application directories, so the
container continues operating without root privileges.
Source: Linters/SAST tools
|
|
||
| --- | ||
| Happy Learning! 🚀👨💻👩💻 | ||
| # forked repo : abhiMahata (13/8/26) |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Correct the future-dated README metadata.
13/8/26 and the screenshot names containing 2026-08-13 refer to August 13, 2026. The current review date is August 12, 2026. If this README documents work completed before merge, use the actual date in an unambiguous format such as August 12, 2026.
Also applies to: 79-82
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 51, Update the README metadata date in the “forked repo :
abhiMahata” entry and the related screenshot names around the referenced section
from August 13, 2026 to the actual review date, August 12, 2026, using an
unambiguous date format where displayed.
1 participant
The current deployment files reference a private AWS ECR registry
(407622020962.dkr.ecr.us-east-1.amazonaws.com) which is inaccessible
to anyone outside the original author's AWS account.
This PR replaces the private images with publicly accessible alternatives
so the manifests work out of the box for anyone trying to learn from
this repo.
Changes made:
Tested on a live Kubernetes cluster , all pods confirmed reach Running state. Screenshot proof attached in modified README.md.
Summary by CodeRabbit
Deployment
Documentation