Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed various docker vulnerabilities #66

Merged
merged 5 commits into from
Sep 10, 2021

Conversation

applejag
Copy link
Contributor

@applejag applejag commented Sep 9, 2021

Summary

  • Strip away patch version from docker base images.
  • Removed building dependencies make and python. They were introduced pre-GitHub with no comment on why they were needed. The docker build succeeds without them, so gone they go.
  • Force update libgcrypt from nginx Docker base image.

Motivation

Resolve vulnerability issues reported by trivy, which is used to scan in both quay.io and harbor.

@applejag applejag added the bug Something isn't working label Sep 9, 2021
@applejag applejag added this to In progress in Backlog via automation Sep 9, 2021
@applejag applejag self-assigned this Sep 9, 2021
Dockerfile Outdated Show resolved Hide resolved
@applejag applejag mentioned this pull request Sep 10, 2021
Dockerfile Outdated Show resolved Hide resolved
Dockerfile Outdated Show resolved Hide resolved
Backlog automation moved this from In progress to Reviewer approved Sep 10, 2021
@fredx30 fredx30 self-requested a review September 10, 2021 11:06
Copy link
Contributor

@fredx30 fredx30 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this is merged without the tag changes i think we should have a discussion at the team meeting about manual controll of version updates and the time cost of retaining a high level control.

@applejag
Copy link
Contributor Author

If this is merged without the tag changes i think we should have a discussion at the team meeting about manual controll of version updates and the time cost of retaining a high level control.

I'll accept your suggestions, but I think it would be good to still have a verbal chat about this. Perhaps on the next bi-weekly meeting?

Co-authored-by: Fredrik <fdyrvold@outlook.com>
applejag added a commit that referenced this pull request Sep 13, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
No open projects
Development

Successfully merging this pull request may close these issues.

None yet

3 participants