Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Docker base image #50

Closed
r-glyde opened this issue Mar 18, 2021 · 1 comment
Closed

Update Docker base image #50

r-glyde opened this issue Mar 18, 2021 · 1 comment

Comments

@r-glyde
Copy link
Contributor

r-glyde commented Mar 18, 2021

Some vulnerabilities have been identified in the final docker image from scans carried out internally. The majority of these are coming from the underlying OS (and minority from old dependencies and java version).

Internally we have fixed this in other projects by switching to distroless images from google which are extremely minimal (basically only containing java). I'm not sure if that is going to be the best solution here as we don't know exactly how other users are using this. Even internally, different templating engines are installed in different projects and that would no longer work with distroless.

I think the majority of these issues can be resolved by just upgrading to the latest stable versions of alpine and java 11. Also, there shouldn't be any need to do things like installing bash into the base image (but if we keep alpine at least if gives the option to users to easily install whatever then need e.g. to debug or add templating to the configuration).

@r-glyde
Copy link
Contributor Author

r-glyde commented Mar 24, 2021

The majority of these issues were resolved in #51 (available in version 0.14.0). I've created #52, #54 and #55 to cover the remaining issues individually.

@r-glyde r-glyde closed this as completed Mar 24, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant