能否为现有FROM scratch Docker容器追加rootfs.tar.gz以添加Shell访问？

Absolutely! While you can't modify an existing Docker image directly, there are two reliable ways to add a root filesystem (and thus shell access) to a scratch-based container like kelseyhightower/contributors. Let's break them down:

Method 1: Rebuild the Image with RootFS #

Your initial Dockerfile approach was on the right track—likely the failure stemmed from a small oversight (like missing the rootfs file in your build context or architecture mismatch). Here's how to make it work:

1. Grab a compatible RootFS archive: Download a rootfs tarball matching the architecture of your original binary (e.g., Alpine's rootfs—pick the version/arch that matches your contributors binary).
2. Create a new Dockerfile:

FROM kelseyhightower/contributors
# Docker's ADD command automatically extracts tar archives to the target path
ADD rootfs.tar.xz /
# Set default command to launch the shell
CMD ["/bin/sh"]

3. Build the modified image:
   Make sure rootfs.tar.xz is in the same directory as your Dockerfile, then run:

docker build -t contributors-with-shell .

4. Run the container with shell access:

docker run -it contributors-with-shell

Why your initial attempt failed: #

• Double-check that rootfs.tar.xz was actually in your build context (the directory you run docker build from). Docker won't access files outside this context by default.
• Ensure the rootfs architecture matches your binary (e.g., don't use an ARM rootfs with an amd64 binary—this will cause "exec format error" when trying to run /bin/sh).

Method 2: Mount RootFS Temporarily (No Rebuild Needed) #

If you don't want to create a new image, you can mount a local rootfs directory directly into the container at runtime:

1. Extract the rootfs locally:

mkdir alpine-rootfs
tar -xf rootfs.tar.xz -C alpine-rootfs

2. Run the container with the mounted rootfs:

docker run -it \
  --mount type=bind,source=$(pwd)/alpine-rootfs,target=/rootfs \
  kelseyhightower/contributors \
  /rootfs/bin/sh

This gives you immediate shell access without altering the original image. If your contributors binary is dynamically linked, you'll need to set the library path to use the rootfs's libraries:

docker run -it \
  --mount type=bind,source=$(pwd)/alpine-rootfs,target=/rootfs \
  -e LD_LIBRARY_PATH=/rootfs/lib \
  kelseyhightower/contributors \
  /rootfs/bin/sh

Key Notes #

• Architecture compatibility is critical: The rootfs must match the CPU architecture of the binary in your scratch image (amd64, arm64, etc.). Mismatches will lead to execution errors.
• Static vs. dynamic binaries: If your original binary is statically compiled (most scratch-based Go binaries are), you won't need to worry about library dependencies—adding the rootfs just gives you the shell and utilities.

内容的提问来源于stack exchange，提问作者hawkeye