<p>I'm trying to emulate <a href="https://github.com/grpc-ecosystem/grpc-health-probe" rel="nofollow noreferrer">theRUN step</a> you would fine in a docker file shown below in the <a href="https://github.com/bazelbuild/rules_docker/blob/master/docs/container.md#container_image" rel="nofollow noreferrer">Bazel docker container image rule</a> but since the <code>container_image</code> rule does not have a copy function I'm trying to use what is available.</p>
<pre><code>RUN GRPC_HEALTH_PROBE_VERSION=v0.3.1 &amp;&amp; \
    wget -qO/bin/grpc_health_probe https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/${GRPC_HEALTH_PROBE_VERSION}/grpc_health_probe-linux-amd64 &amp;&amp; \
    chmod +x /bin/grpc_health_probe
</code></pre>
<pre><code>  go_image(
      name = &quot;go_auth_image&quot;,
      embed = [&quot;:go-auth_lib&quot;],
      visibility = [&quot;//visibility:public&quot;],
  )

  container_image(
      name = &quot;go_auth_api&quot;,
      visibility = [&quot;//visibility:public&quot;],
      base = &quot;:go_auth_image&quot;,
      ports = [&quot;5001&quot;, &quot;5002&quot;],
      files = [&quot;grpc_health_probe-linux-amd64&quot;],
      symlinks = {
          &quot;grpc_health_prob-linux-amd64&quot;: &quot;/bin/grpc_health_probe&quot;,
      },
      cmd = [
          &quot;apk add --no-cache git&quot;,
          &quot;chmod +x /bin/grpc_health_probe&quot;,
      ],
  )
</code></pre>
<p>note: <code>file_map</code> does not seem to be a parameter for <code>container_image</code></p>
<p>When I deploy this image to k8s the the image runs fine but the when describing the pod the liveness probe (described below) fails.</p>
<pre class="lang-yaml prettyprint-override"><code>          livenessProbe:
            exec:
              command: [&quot;/bin/grpc_health_probe&quot;, &quot;-addr=:5002&quot;]
            initialDelaySeconds: 5
            periodSeconds: 30
            timeoutSeconds: 2
            successThreshold: 1
            failureThreshold: 3
</code></pre>
<pre><code>  Warning  Unhealthy  6m42s                  kubelet            Liveness probe errored: rpc error: code = Unknown desc = failed to exec in container: failed to start exec &quot;b6c89b7ec907e572f80be59e8d4b5cad6535a3479d67a3563a09e0d1d2f7ca03&quot;: OCI runtime exec failed: exec failed: container_linux.go:370: starting container process caused: exec: &quot;/bin/grpc_health_probe&quot;: stat /bin/grpc_health_probe: no such file or directory: unknown
</code></pre>
<p>What is the correct way to setup this probe with Bazel (I've confirmed this works with a Dockerfile setup)</p>

<p><a href="https://github.com/bazelbuild/rules_docker/blob/master/docker/util/README.md#container_run_and_commit" rel="nofollow noreferrer">container_run_and_commit</a> is the closest equivalent to <code>RUN</code>. Something like this is the direct equivalent:</p>
<pre class="lang-py prettyprint-override"><code>load(&quot;@io_bazel_rules_docker//docker/util:run.bzl&quot;, &quot;container_run_and_commit&quot;)

GRPC_HEALTH_PROBE_VERSION = &quot;v0.3.1&quot;

container_run_and_commit(
    name = &quot;install_stuff&quot;,
    image = &quot;:go_auth_image.tar&quot;,
    commands = [
        &quot;wget -qO/bin/grpc_health_probe https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/%s/grpc_health_probe-linux-amd64&quot; % GRPC_HEALTH_PROBE_VERSION,
        &quot;chmod +x /bin/grpc_health_probe&quot;,
    ],
)


container_image(
    name = &quot;go_auth_api&quot;,
    visibility = [&quot;//visibility:public&quot;],
    base = &quot;:install_stuff&quot;,
    ... # everything else you're doing with container_image
)
</code></pre>
<p>It runs the commands a builds a new image, and then uses <code>container_image</code> to add things to the result.</p>
<p>However, doing more of the build with bazel will make better use of bazel's cache and be more reproducible. I think that's what you're doing with the <code>grpc_health_probe-linux-amd64</code> source file. That approach looks something like this:</p>
<pre class="lang-py prettyprint-override"><code>load(&quot;@io_bazel_rules_docker//docker/util:run.bzl&quot;, &quot;container_run_and_commit&quot;)

container_image(
    name = &quot;add_stuff&quot;,
    base = &quot;:go_auth_image&quot;,
    ports = [&quot;5001&quot;, &quot;5002&quot;],
    files = [&quot;grpc_health_probe-linux-amd64&quot;],
    symlinks = {
        &quot;grpc_health_prob-linux-amd64&quot;: &quot;/bin/grpc_health_probe&quot;,
    },
)

container_run_and_commit(
    name = &quot;go_auth_api&quot;,
    visibility = [&quot;//visibility:public&quot;],
    image = &quot;:add_stuff.tar&quot;,
    commands = [
        &quot;apk add --no-cache git&quot;,
        &quot;chmod +x /bin/grpc_health_probe&quot;,
    ],
)
</code></pre>
<p>That uses <code>container_image</code> to add things first, and then runs the commands afterwards.</p>
<p>Also, instead of running <code>chmod +x</code>, you can use <a href="https://github.com/bazelbuild/rules_pkg/blob/main/pkg/docs/reference.md#pkg_tar" rel="nofollow noreferrer">pkg_tar</a> to package the file+symlink (it has a <code>symlinks</code> attribute just like <code>container_image</code>), and then set <code>mode = 0755</code>. <code>container_image.tars</code> will take the tar file and add it to the image. In general, <code>pkg_tar</code> gives a lot of flexibility for building up files, and <code>container_image</code> takes a subset of its functionality directly for simple use cases.</p>
<p><a href="https://github.com/bazelbuild/rules_docker/blob/master/docs/container.md#container_image" rel="nofollow noreferrer">container_image.cmd</a> is the equivalent of <code>CMD</code> in a Dockerfile. It's just setting the information when the container is used, not doing anything while building it. I don't think you want to use it at all for this.</p>
