Chainguard Container for spamcheck-fips

Spamcheck is a gRPC-based spam classification service for GitLab

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/spamcheck-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

The Chainguard spamcheck-fips container image is a drop-in replacement for the upstream Gitlab Spamcheck image. It offers the same functionality as the upstream for gRPC spam detection. This image is designed to be a minimal, secure alternative that runs as a non-root user. Switching to this image may require minor adjustments to your existing deployment configuration.

The Chainguard spamcheck image does not include the proprietary spam_classifiers component used for machine learning-based detection. This closed-source component must be obtained from GitLab and provided to the container at runtime.

FIPS Support

This Chainguard Container ships with a validated redistribution of OpenSSL's FIPS provider module. For more on FIPS support in Chainguard Containers, consult the guide on FIPS-enabled Chainguard Containers on Chainguard Academy.

Getting Started

Quick Start with Docker

This example requires you to have spam_classifiers component available locally.

docker run -d \
  -p 8001:8001 \
  -v /path/to/spam_classifiers:/spam_classifiers:ro \
  -e PYTHONPATH="/spam_classifiers:/usr/lib/python3.10/site-packages" \
  -e GRPC_ADDR="0.0.0.0:8001" \
  -e LOG_LEVEL="info" \
  cgr.dev/ORGANIZATION/spamcheck-fips:latest

Quick Start with Kubernetes

For production use, spamcheck is typically deployed to Kubernetes with an init container that downloads the spam_classifiers component and its dependencies. Below is a complete example:

Create Namespace and ConfigMap

kubectl create namespace spamcheck

Create a ConfigMap with a script to download spam_classifiers:

kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
metadata:
  name: spamcheck-download-script
  namespace: spamcheck
data:
  download-classifiers.sh: |
    #!/bin/sh
    set -e
    echo "Downloading spam_classifiers dependencies..."
    python3.10 -m pip install --target=/shared/site-packages \
      --only-binary=:all: \
      'numpy<2' \
      'scikit-learn==1.5.2' \
      'scipy' \
      'joblib' \
      'threadpoolctl'

    # Download spam_classifiers from GitLab GCS bucket
    SPAM_CLASSIFIERS_URL="\${SPAM_CLASSIFIERS_URL:-https://storage.googleapis.com/glsec-spamcheck-ml-artifacts/spam-classifier/pip/4.2.1/spam_classifiers-4.2.1.tar.gz}"

    cd /tmp
    wget -O spam_classifiers.tar.gz "\${SPAM_CLASSIFIERS_URL}"

    echo "Extracting spam_classifiers..."
    tar -xzf spam_classifiers.tar.gz
    cd spam_classifiers-4.2.1
    python3.10 -m pip install --no-deps --target=/shared/site-packages .
EOF

Deploy Spamcheck

kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: spamcheck
  namespace: spamcheck
spec:
  replicas: 1
  selector:
    matchLabels:
      app: spamcheck
  template:
    metadata:
      labels:
        app: spamcheck
    spec:
      initContainers:
      - name: download-spam-classifiers
        image: cgr.dev/ORGANIZATION/python:3.10-dev
        command: ["/bin/sh", "/scripts/download-classifiers.sh"]
        env:
        - name: SPAM_CLASSIFIERS_URL
          value: "https://storage.googleapis.com/glsec-spamcheck-ml-artifacts/spam-classifier/pip/4.2.1/spam_classifiers-4.2.1.tar.gz"
        volumeMounts:
        - name: shared-packages
          mountPath: /shared/site-packages
        - name: download-script
          mountPath: /scripts
      containers:
      - name: spamcheck
        image: cgr.dev/ORGANIZATION/spamcheck-fips:latest
        ports:
        - containerPort: 8001
          name: grpc
          protocol: TCP
        env:
        - name: GRPC_ADDR
          value: "0.0.0.0:8001"
        - name: LOG_LEVEL
          value: "info"
        - name: PYTHONPATH
          value: "/shared/site-packages:/usr/lib/python3.10/site-packages"
        - name: LANG
          value: "C.UTF-8"
        - name: LC_ALL
          value: "C.UTF-8"
        - name: PYTHONDONTWRITEBYTECODE
          value: "1"
        - name: PYTHONFAULTHANDLER
          value: "1"
        - name: TF_CPP_MIN_LOG_LEVEL
          value: "2"
        volumeMounts:
        - name: shared-packages
          mountPath: /shared/site-packages
      volumes:
      - name: shared-packages
        emptyDir: {}
      - name: download-script
        configMap:
          name: spamcheck-download-script
          defaultMode: 0755
---
apiVersion: v1
kind: Service
metadata:
  name: spamcheck
  namespace: spamcheck
spec:
  selector:
    app: spamcheck
  ports:
  - port: 8001
    targetPort: 8001
    protocol: TCP
    name: grpc
  type: ClusterIP
EOF

Verify Deployment

Wait for the deployment to become ready:

kubectl wait --for=condition=Available -n spamcheck deployment/spamcheck --timeout=30s

Check the logs:

kubectl logs -n spamcheck -l app=spamcheck

Documentation and Resources

• GitLab Repo
• GitLab Akismet Anti-Spam Documentation
• GitLab's Spamcheck documentation

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.