Change to use Chainguard MinIO container #27095

mosabua · 2025-10-24T18:23:11Z

Description

Change to use the MinIO container image from Chainguard Containers. Only "latest" is available so I am trying with that.

This PR is just an initial test for now.

Additional context and related issues

MinIO no longer publishes updated to their container images and even the latest one has CVEs reported against it.

Release notes

(x) This is not user-visible or is docs only, and no release notes are required.

sourcery-ai · 2025-10-24T18:23:19Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR updates all MinIO test containers to use the Chainguard MinIO image (cgr.dev/chainguard/minio) with the 'latest' tag by replacing fixed release constants and adjusting DockerContainer references.

Class diagram for updated Minio container image reference

classDiagram
  class Minio {
    - Logger log
    + DEFAULT_IMAGE : String = "cgr.dev/chainguard/minio"
    + DEFAULT_HOST_NAME : String
    + MINIO_API_PORT : int
  }

File-Level Changes

Change	Details	Files
Consolidate MinIO version references to 'latest' and simplify default image	Set MINIO_RELEASE constant to 'latest' in SpoolingMinio Set MINIO_RELEASE constant to 'latest' in common Minio environment Update DEFAULT_IMAGE to use Chainguard image without explicit tag	`testing/trino-product-tests-launcher/src/main/java/io/trino/tests/product/launcher/env/environment/SpoolingMinio.java` `testing/trino-product-tests-launcher/src/main/java/io/trino/tests/product/launcher/env/common/Minio.java` `testing/trino-testing-containers/src/main/java/io/trino/testing/containers/Minio.java`
Switch DockerContainer image source to Chainguard registry	Change image reference in SpoolingMinio to cgr.dev/chainguard/minio Change image reference in common Minio to cgr.dev/chainguard/minio	`testing/trino-product-tests-launcher/src/main/java/io/trino/tests/product/launcher/env/environment/SpoolingMinio.java` `testing/trino-product-tests-launcher/src/main/java/io/trino/tests/product/launcher/env/common/Minio.java`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

sourcery-ai

Hey there - I've reviewed your changes and they look great!

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

findepi · 2025-10-24T21:02:25Z

...o-product-tests-launcher/src/main/java/io/trino/tests/product/launcher/env/common/Minio.java

    private static final String MINIO_ACCESS_KEY = "minio-access-key";
    private static final String MINIO_SECRET_KEY = "minio-secret-key";
-    private static final String MINIO_RELEASE = "RELEASE.2025-01-20T14-49-07Z";
+    private static final String MINIO_RELEASE = "latest";


Change to use the MinIO container image from Chainguard Containers. Only "latest" is available so I am trying with that.

we need reproducible builds and deterministic tests. My "latest" won't be the same as your "latest".

how do we achieve that?

do we need to copy the container into ghcr trino org and tag ourselves?

It's possible to pull the image using the hash:

docker pull cgr.dev/chainguard/minio@sha256:66bd82c8fe5e75868ae7d0b2e102d9a0dcf971b270a41bd060a9e6a643476ff8

Maybe this also works with Testcontainers?

Confirmed, that syntax works fine. We should see if we can centralize the version instead of copying it in multiple places.

The digests and all will continue to be avaiable so we can either tag ourselves with something like a date value or we can use hashes.

We can use a single constant of the form

MINIO_IMAGE = "cgr.dev/chainguard/minio@sha256:66bd82c8fe5e75868ae7d0b2e102d9a0dcf971b270a41bd060a9e6a643476ff8";

That seems fine with me as well. Should I refactor the code to use a constant along those lines?

Yeah, let’s do that if it’s possible without messing up the module structure. I haven’t looked at the dependencies between these locations.

electrum · 2025-10-24T21:30:31Z

The Minio container seems to be returning 403 errors. I see these in the minio container logs:

API: ListObjectsV2(bucket=test-bucket)
Time: 19:37:23 UTC 10/24/2025
DeploymentID: a950e157-b70b-463f-9ce4-82c331e7c000
RequestID: 18718486BF8418FE
RemoteHost: 172.18.0.4
Host: minio:9080
UserAgent: aws-sdk-java/2.36.1 md/io#sync md/http#Apache ua/2.1 api/S3#2.36.x os/Linux#6.11.0-1018-azure lang/java#25 md/OpenJDK_64-Bit_Server_VM#25+36-LTS md/vendor#Eclipse_Adoptium md/en_US md/kotlin/2.2.20-release-333 app/Trino m/D,N,N,C,e
Error: file access denied (cmd.StorageErr)
       7: internal/logger/logonce.go:118:logger.(*logOnceType).logOnceIf()
       6: internal/logger/logonce.go:149:logger.LogOnceIf()
       5: cmd/logging.go:116:cmd.internalLogOnceIf()
       4: cmd/metacache-walk.go:184:cmd.(*xlStorage).WalkDir.func3()
       3: cmd/metacache-walk.go:406:cmd.(*xlStorage).WalkDir()
       2: cmd/metacache-walk.go:419:cmd.(*xlStorageDiskIDCheck).WalkDir()
       1: cmd/metacache-set.go:1050:cmd.listPathRaw.func3()

Which results in this exception on the Hive metastore side:

Caused by: io.trino.hive.thrift.metastore.MetaException: Got exception: java.nio.file.AccessDeniedException s3a://test-bucket/test_hive_orc_legacy_date_compatibility_5l6d06aifd: getFileStatus on s3a://test-bucket/test_hive_orc_legacy_date_compatibility_5l6d06aifd: com.amazonaws.services.s3.model.AmazonS3Exception: Forbidden (Service: Amazon S3; Status Code: 403; Error Code: 403 Forbidden; Request ID: 18718486C7A41AC8; S3 Extended Request ID: 4b51e88a8a967ce09da1fc1d19f7299b638740a99d000967a4bf556e1518031f; Proxy: null), S3 Extended Request ID: 4b51e88a8a967ce09da1fc1d19f7299b638740a99d000967a4bf556e1518031f:403 Forbidden

mosabua · 2025-10-24T21:48:35Z

@imjasonh @xnox @amouat can you look at the output from @electrum and check out what is going on there? I have a feeling it has something do to with different user setup or permissions in our Chainguard container.

electrum · 2025-10-24T21:53:09Z

Note that the log lines above are from the GHA logs for the failed jobs in this PR. I stripped out the prefix from each line to make them more readable.

xnox · 2025-10-25T00:59:49Z

Chainguard build of minio defaults to running unprivileged.
The previous minio builds defaulted to running as root.

Thus to have compatibility, one would need to either ensure data / volume mounts use the same unprivileged uid shift inside the container,
or run as root at launch with -u0 / --user 0 in docker run option terms - adapted as appropriate for your container runtime.

cla-bot bot added the cla-signed label Oct 24, 2025

sourcery-ai bot reviewed Oct 24, 2025

View reviewed changes

Change to use Chainguard MinIO container

a644c11

mosabua force-pushed the minio branch from 36c0b9b to a644c11 Compare October 24, 2025 19:23

findepi reviewed Oct 24, 2025

View reviewed changes

Change to use Chainguard MinIO container #27095

Are you sure you want to change the base?

Change to use Chainguard MinIO container #27095

Conversation

mosabua commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Additional context and related issues

Release notes

Uh oh!

sourcery-ai bot commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

Class diagram for updated Minio container image reference

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

findepi Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

findepi Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

electrum Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

electrum Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

mosabua Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

electrum Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

mosabua Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

electrum Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

electrum commented Oct 24, 2025

Uh oh!

mosabua commented Oct 24, 2025

Uh oh!

electrum commented Oct 24, 2025

Uh oh!

xnox commented Oct 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

mosabua commented Oct 24, 2025 •

edited

Loading

sourcery-ai bot commented Oct 24, 2025 •

edited

Loading

mosabua Oct 24, 2025 •

edited

Loading