From 37282e11c424f6902a976e42f0ad1978da674aff Mon Sep 17 00:00:00 2001 From: Jeff Cantrill Date: Thu, 24 Sep 2026 12:03:54 -0400 Subject: [PATCH] feat(lfme): run exporter directly without a bash shell wrapper (LOG-10201) The LogFileMetricExporter container was started via /bin/bash -c " ", which requires bash in the image and inserts a shell as PID 1. Set the container command to the exporter binary directly with each flag as a discrete arg (no shell interpolation was relied upon). This removes the runtime dependency on bash, enabling a smaller/hardened base image (e.g. ubi-micro), and runs the exporter as PID 1 for correct signal handling. Co-Authored-By: Claude Opus 4.8 --- .../metrics/logfilemetricexporter/factory.go | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/internal/metrics/logfilemetricexporter/factory.go b/internal/metrics/logfilemetricexporter/factory.go index 914652415..908915603 100644 --- a/internal/metrics/logfilemetricexporter/factory.go +++ b/internal/metrics/logfilemetricexporter/factory.go @@ -112,11 +112,18 @@ func newLogMetricsExporterContainer(exporter loggingv1a1.LogFileMetricExporter, Protocol: v1.ProtocolTCP, }, } - exporterContainer.Command = []string{"/bin/bash"} - exporterContainer.Args = []string{"-c", - "/usr/local/bin/log-file-metric-exporter -verbosity=2 -dir=/var/log/pods -http=:2112 -keyFile=/etc/logfilemetricexporter/metrics/tls.key -crtFile=/etc/logfilemetricexporter/metrics/tls.crt -secureMetrics -tlsMinVersion=" + - tls.MinTLSVersion(tlsProfileSpec) + " -cipherSuites=" + strings.Join(tls.TLSCiphers(tlsProfileSpec), ",") + - " -groups=" + strings.Join(tls.TLSGroups(tlsProfileSpec), ",")} + exporterContainer.Command = []string{"/usr/local/bin/log-file-metric-exporter"} + exporterContainer.Args = []string{ + "-verbosity=2", + "-dir=/var/log/pods", + "-http=:2112", + "-keyFile=/etc/logfilemetricexporter/metrics/tls.key", + "-crtFile=/etc/logfilemetricexporter/metrics/tls.crt", + "-secureMetrics", + "-tlsMinVersion=" + tls.MinTLSVersion(tlsProfileSpec), + "-cipherSuites=" + strings.Join(tls.TLSCiphers(tlsProfileSpec), ","), + "-groups=" + strings.Join(tls.TLSGroups(tlsProfileSpec), ","), + } exporterContainer.VolumeMounts = []v1.VolumeMount{ {Name: logContainers, ReadOnly: true, MountPath: logContainersValue},