Containerfile: Use Icinga 2 Plugin Container by oxzi · Pull Request #11161 · Icinga/icinga2

oxzi · 2026-11-06T14:02:05Z

Outsource pinned check commands to an external container image¹. This uncouples their versions from our Containerfile, belonging to a certain git tag. Afterward, the plugins can be updated independently of an Icinga 2 release.

Furthermore, the new container image¹ comes with an SBOM of all check plugins. When inspecting the container image, these artifacts are now being picked up.

$ for c in mssql_health nwc_health postgres.pl ssl_cert; do podman run -t -it --rm icinga2:edge "/usr/lib/nagios/plugins/check_$c" --version; podman run -t -it --rm icinga2:external-plugins "/usr/lib/nagios/plugins/check_$c" --version; echo; done
[2026-11-06 14:00:11 +0000] information/DockerEntrypoint: Icinga 2 Docker entrypoint script started.
[2026-11-06 14:00:11 +0000] information/DockerEntrypoint: No node setup required based on environment variables.
[2026-11-06 14:00:11 +0000] information/DockerEntrypoint: Finished Icinga 2 Docker entrypoint script.
check_mssql_health (1.5.10)
This nagios plugin comes with ABSOLUTELY NO WARRANTY. You may redistribute
copies of this plugin under the terms of the GNU General Public License.
[2026-11-06 14:00:12 +0000] information/DockerEntrypoint: Icinga 2 Docker entrypoint script started.
[2026-11-06 14:00:12 +0000] information/DockerEntrypoint: No node setup required based on environment variables.
[2026-11-06 14:00:12 +0000] information/DockerEntrypoint: Finished Icinga 2 Docker entrypoint script.
check_mssql_health $Revision: 2.9 $ [http://labs.consol.de/nagios/check_mssql_health]

[2026-11-06 14:00:12 +0000] information/DockerEntrypoint: Icinga 2 Docker entrypoint script started.
[2026-11-06 14:00:12 +0000] information/DockerEntrypoint: No node setup required based on environment variables.
[2026-11-06 14:00:12 +0000] information/DockerEntrypoint: Finished Icinga 2 Docker entrypoint script.
check_nwc_health $Revision: 1.4.9 $ [http://labs.consol.de/nagios/check_nwc_health]
[2026-11-06 14:00:12 +0000] information/DockerEntrypoint: Icinga 2 Docker entrypoint script started.
[2026-11-06 14:00:12 +0000] information/DockerEntrypoint: No node setup required based on environment variables.
[2026-11-06 14:00:12 +0000] information/DockerEntrypoint: Finished Icinga 2 Docker entrypoint script.
check_nwc_health $Revision: 12.17.2 $ [http://labs.consol.de/nagios/check_nwc_health]

[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: Icinga 2 Docker entrypoint script started.
[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: No node setup required based on environment variables.
[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: Finished Icinga 2 Docker entrypoint script.
check_postgres.pl version 2.25.0
[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: Icinga 2 Docker entrypoint script started.
[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: No node setup required based on environment variables.
[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: Finished Icinga 2 Docker entrypoint script.
check_postgres.pl version 2.26.0

[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: Icinga 2 Docker entrypoint script started.
[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: No node setup required based on environment variables.
[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: Finished Icinga 2 Docker entrypoint script.
check_ssl_cert version 2.81.1
[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: Icinga 2 Docker entrypoint script started.
[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: No node setup required based on environment variables.
[2026-11-06 14:00:13 +0000] information/DockerEntrypoint: Finished Icinga 2 Docker entrypoint script.
check_ssl_cert version 2.103.4

$ podman run -t -it --rm icinga2:external-plugins /usr/lib/nagios/plugins/check_ssl_cert -H icinga.com -c 3 -p 443 -w 7
[2026-11-06 13:53:23 +0000] information/DockerEntrypoint: Icinga 2 Docker entrypoint script started.
[2026-11-06 13:53:23 +0000] information/DockerEntrypoint: No node setup required based on environment variables.
[2026-11-06 13:53:23 +0000] information/DockerEntrypoint: Finished Icinga 2 Docker entrypoint script.
SSL_CERT OK - icinga.com:443, https, x509 certificate '*.icinga.com' (icinga.com) from 'Let's Encrypt' valid until Dec 14 08:24:39 2026 GMT (expires in 37 days)|days_chain_elem1=37;7;3;; days_chain_elem2=666;7;3;; days_chain_elem3=2127;7;3;; days_chain_elem4=2127;7;3;;

Fixes Icinga/docker-icinga2#170
Refs #10984

https://github.com/Icinga/icinga2-plugins-container ↩ ↩²

yhabteab · 2026-11-06T14:20:51Z

Fixes Icinga/docker-icinga2#170

That issue is basically a duplicate of #10984 and is quite similar to #10854, so if fixing that issue with this PR, you could also fix both of the Icinga 2 issues as well.

julianbrost · 2026-11-06T15:02:23Z

IMHO this PR is now starting to mix too many things and it's hard to follow, what change is done for what reason now. Please split this into individual commits at least.

In addition, the "--no-install-recommends" flag was lifted from "apt-get install", mirroring the old behavior before switching to the new Containerfile.

Which typically adds a lot of bloat as well. So please check what impact this has on the image size. Comparing the package lists and only adding what seems reasonably might be an idea as well. There haven't been a lot of complaints, and that might be a better balance between compatibility and image size.

oxzi · 2026-11-06T15:09:45Z

IMHO this PR is now starting to mix too many things and it's hard to follow, what change is done for what reason now. Please split this into individual commits at least.

In addition, the "--no-install-recommends" flag was lifted from "apt-get install", mirroring the old behavior before switching to the new Containerfile.

Which typically adds a lot of bloat as well. So please check what impact this has on the image size. Comparing the package lists and only adding what seems reasonably might be an idea as well. There haven't been a lot of complaints, and that might be a better balance between compatibility and image size.

Fair, I am going to drop the --no-install-recommends thingy. This is something for the future.

yhabteab · 2026-11-06T15:11:09Z

In addition, the "--no-install-recommends" flag was lifted from "apt-get install", mirroring the old behavior before switching to the new Containerfile.

Which typically adds a lot of bloat as well. So please check what impact this has on the image size. Comparing the package lists and only adding what seems reasonably might be an idea as well.

I think, this makes a lot of difference. As states this in #10854:

This resulted in a smaller image as less packages are being installed (188 instead of 265), but the python interpreter is no longer available.

I would also suggest to just install the missing packages as reported by users instead of doing the same thing what the old image did. That way, we would at least know why we're installing that many packages in our official image.

oxzi · 2026-11-10T08:20:16Z

@julianbrost: Please take another look. The container image now copies everything from icinga2-plugins-container, pinned to the "wandering" tag trixie, which gets automatically reassigned for each new icinga2-plugins-container release.

julianbrost · 2026-11-11T09:55:57Z

+COPY --from=ghcr.io/icinga/icinga2-plugins-container:trixie /usr/lib/nagios/plugins/* /usr/lib/nagios/plugins/
+COPY --from=ghcr.io/icinga/icinga2-plugins-container:trixie /plugins.cdx.json /usr/share/sbom/
+
 # Install the necessary runtime dependencies for the Icinga 2 binary and the monitoring-plugins.
-RUN apt-get update && \
-    apt-get upgrade -y && \
+RUN --mount=from=ghcr.io/icinga/icinga2-plugins-container:trixie,target=/plugins \


I'd introduce a build ARG for the image name. That avoids repeating it three times now and has the added benefit that you can build against a different version for testing purposes without having to modify the file.

Thought about that but wanted to keep the diff small. Now, there is a global DEBIAN_VERSION to substitute trixie.

Containerfile:122 -------------------- 121 | # Install the necessary runtime dependencies for the Icinga 2 binary and the monitoring-plugins. 122 | >>> RUN --mount=from=ghcr.io/icinga/icinga2-plugins-container:${DEBIAN_VERSION},target=/plugins \ 123 | >>> apt-get update && \ 124 | >>> DEBIAN_FRONTEND=noninteractive apt-get upgrade -y && \ 125 | >>> DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends --no-install-suggests \ 126 | >>> bc \ 127 | >>> ca-certificates \ 128 | >>> curl \ 129 | >>> dumb-init \ 130 | >>> file \ 131 | >>> libboost-context1.83.0 \ 132 | >>> libboost-coroutine1.83.0 \ 133 | >>> libboost-date-time1.83.0 \ 134 | >>> libboost-filesystem1.83.0 \ 135 | >>> libboost-iostreams1.83.0 \ 136 | >>> libboost-program-options1.83.0 \ 137 | >>> libboost-regex1.83.0 \ 138 | >>> libboost-system1.83.0 \ 139 | >>> libboost-thread1.83.0 \ 140 | >>> libcap2-bin \ 141 | >>> libedit2 \ 142 | >>> libldap-common \ 143 | >>> libmariadb3 \ 144 | >>> libmoosex-role-timer-perl \ 145 | >>> libpq5 \ 146 | >>> libprotobuf-lite32t64 \ 147 | >>> libssl3 \ 148 | >>> libsystemd0 \ 149 | >>> mailutils \ 150 | >>> monitoring-plugins \ 151 | >>> msmtp \ 152 | >>> msmtp-mta \ 153 | >>> openssh-client \ 154 | >>> openssl \ 155 | >>> $(cat /plugins/debian-packages) && \ 156 | >>> # Official Debian images automatically run `apt-get clean` after every install, so we don't need to do it here. 157 | >>> rm -rf /var/lib/apt/lists/* 158 | -------------------- ERROR: failed to build: failed to solve: dockerfile parse error on line 122: 'from' doesn't support variable expansion, define alias stage instead

-- https://github.com/Icinga/icinga2/actions/runs/43001166329/job/130457548175

Oh noe :(

I have tested this locally with Podman, where it worked. So, I am going to undo this change, as otherwise there would be ARG usage everywhere except here, which would look very bug-ish.

Undo.

FTR: It looked like this: https://github.com/Icinga/icinga2/compare/e73194f333e5d2fbca05e6fdb4c7e5dfcb55da6f..edc4c7661745e92a9849c6c6b180111e810699a4

Wait, I would test if creating an intermediate stage would do.

Sorry using this thread as a chat with myself.

One more try. As I just rumbled, I created an intermediate container stage where the ARG substitution is used in the FROM. It worked locally with Podman and the CI is past that step; seems to be working. Yay.

and has the added benefit that you can build against a different version for testing purposes without having to modify the file

By only having DEBIAN_VERSION as an ARG, this doesn't really solve what I had in mind there. With the current state, you can't (without editing the file) build this based on an edge version of that image (or a local name of that image).

Okay, I failed to peek into your mind correctly.

I have changed this to introduce an additional PLUGINS_VERSION ARG, defaulting to the DEBIAN_VERSION. Now it is possible to overwrite the Debian main version - including the plugins - as well as just overwriting the plugin version with --build-args.

Was that what you had in mind? Otherwise, please feel free to suggest changes.

I had hoped this doesn't need much peeking into my mind. 😅

I'd introduce a build ARG for the image name.

So that would be ARG PLUGINS_IMAGE=ghcr.io/icinga/icinga2-plugins-container:trixe and using that. This allows using --build-arg PLUGINS_IMAGE=ghcr.io/icinga/icinga2-plugins-container:trixe-edge or also --build-arg PLUGINS_IMAGE=localhost/plugins:dev.

Outsource pinned check commands to an external container image[0]. This uncouples their versions from our Containerfile, belonging to a certain git tag. Afterward, the plugins can be updated independently of an Icinga 2 release. Furthermore, the new container image[0] comes with an SBOM of all check plugins. When inspecting the container image, these artifacts are now being picked up. [0]: https://github.com/Icinga/icinga2-plugins-container

oxzi added this to the 2.17.0 milestone Nov 6, 2026

oxzi requested a review from julianbrost November 6, 2026 14:02

oxzi added area/images Affects Icinga 2 container/docker images. backport-to-support/2.16 PRs with this label will automatically be backported to the v2.16 support branch. labels Nov 6, 2026

cla-bot Bot added the cla/signed label Nov 6, 2026

oxzi mentioned this pull request Nov 6, 2026

check_ssl_cert needs host command which is missing in docker image Icinga/docker-icinga2#170

Open

oxzi removed the request for review from julianbrost November 6, 2026 14:03

julianbrost reviewed Nov 6, 2026

View reviewed changes

Comment thread Containerfile Resolved

oxzi force-pushed the containerfile-use-icinga2-plugins-container branch from 97a86b1 to f997555 Compare November 6, 2026 14:33

This was referenced Nov 6, 2026

Missing binaries in Docker image #10984

Open

New Docker image build system causes no more python3 interpreter in 2.16.0 #10854

Open

oxzi force-pushed the containerfile-use-icinga2-plugins-container branch 3 times, most recently from 832fa6a to 7ef7c92 Compare November 9, 2026 13:11

oxzi marked this pull request as ready for review November 10, 2026 08:17

oxzi requested a review from julianbrost November 10, 2026 08:17

oxzi mentioned this pull request Nov 10, 2026

Containerfile: Use Icinga 2 Plugin Container Icinga/docker-icinga2#171

Draft

julianbrost reviewed Nov 10, 2026

View reviewed changes

Comment thread Containerfile Resolved

Comment thread Containerfile Resolved

oxzi force-pushed the containerfile-use-icinga2-plugins-container branch from 7ef7c92 to e73194f Compare November 11, 2026 09:33

oxzi requested a review from julianbrost November 11, 2026 09:35

julianbrost reviewed Nov 11, 2026

View reviewed changes

oxzi force-pushed the containerfile-use-icinga2-plugins-container branch from e73194f to edc4c76 Compare November 11, 2026 10:09

oxzi requested a review from julianbrost November 11, 2026 10:09

oxzi force-pushed the containerfile-use-icinga2-plugins-container branch 2 times, most recently from e1c9113 to ce19ebd Compare November 11, 2026 10:25

julianbrost mentioned this pull request Nov 11, 2026

Initial review Icinga/icinga2-plugins-container#4

Open

oxzi force-pushed the containerfile-use-icinga2-plugins-container branch from ce19ebd to cc06caa Compare November 11, 2026 11:03

Conversation

oxzi commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Footnotes

Uh oh!

Uh oh!

yhabteab commented Nov 6, 2026

Uh oh!

julianbrost commented Nov 6, 2026

Uh oh!

oxzi commented Nov 6, 2026

Uh oh!

yhabteab commented Nov 6, 2026

Uh oh!

oxzi commented Nov 10, 2026

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

oxzi commented Nov 6, 2026 •

edited

Loading