[Bug][Config-UI] Vulnerabilities in Image

[lavakush07]

Search before asking

• I had searched in the issues and found no similar issues.

What happened

• While I'm trying to setup the Config-UI. I am facing the vulnerabilities in the image.
  
  

What do you expect to happen

Ease in setting up of config-UI.

How to reproduce

While I'm running it on localhost:4000. It is showing me the following error.

Anything else

No response

Version

main

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[keon94]

The vulnerabilities and the error 500 are two different issues. I suggest you file another issue for the error you're seeing and attaching container logs to it.

[lavakush07]

Okay , Surely Will do it.

[hezyin]

Hi @lavakush07, thanks for filing this issue. Two quick questions:

1. Regarding the vulnerabilities, which scanning tool did you use to find them?
2. Regarding the Config-UI error, can you describe how to reproduce it? For example, which version of DevLake you're on and how did you set it up?

[lavakush07]

Hello @hezyin , I am the using the Docker Desktop for scanning the logs and inspecting it.
While I am trying to run the config UI On the browser(localhost://4000) . I am facing this error. The DevLake Version: 0.15
I am attaching the logs here.

[matrixji]

For the security issue, currently, we're using nginxinc/nginx-unprivileged:1.21 as base image for config-ui, as nginx is stable enough, I guess we could use nginxinc/nginx-unprivileged:latest for get latest security updates from the upstream.

[matrixji]

For the security issue, currently, we're using nginxinc/nginx-unprivileged:1.21 as base image for config-ui, as nginx is stable enough, I guess we could use nginxinc/nginx-unprivileged:latest for get latest security updates from the upstream.

Still, use nginxinc/nginx-unprivileged:latest tag in code repo is not a good practice, maybe we could introducing a checklist in release stage to ensure we're including the latest security updates from upstream at that moment.

[lavakush07]

For the security issue, currently, we're using nginxinc/nginx-unprivileged:1.21 as base image for config-ui, as nginx is stable enough, I guess we could use nginxinc/nginx-unprivileged:latest for get latest security updates from the upstream.

Still, use nginxinc/nginx-unprivileged:latest tag in code repo is not a good practice, maybe we could introducing a checklist in release stage to ensure we're including the latest security updates from upstream at that moment.

Got it 👍

[hezyin]

Hi @lavakush07, I tried v0.15.0-rc4 with docker-compose and everything works fine. Do you think you could provide details steps for reproducing the Config-UI issue? Thanks!

[hezyin]

Hi @lavakush07, I'm gonna close this issue due to inactivity. But feel free to open a new issue if you need help.