This repository was archived by the owner on Sep 17, 2026. It is now read-only.
Repository navigation
Bump base-server image, pin apk versions, fix misconfig findings - #336
Open
rajeshk486 wants to merge 2 commits into
Open
rajeshk486 wants to merge 2 commits into
rajeshk486 wants to merge 2 commits into
Conversation
- server.Dockerfile: BASE_SERVER_IMAGE 1.15.15 -> 1.15.25, closing both CRITICAL OS-level CVEs and dropping HIGH findings from 23 to 5 (Alpine) and 36 to 8 (dockerize binary), per verified trivy re-scan. - admin-tools.Dockerfile: pin bash-completion=2.17.0-r1 (hadolint DL3018); document why the temporaliotest/server FROM can't be tag-pinned (it's a bake-injected build-context reference, not a registry pull). - develop.Dockerfile: pin iproute2=6.17.0-r0 (hadolint DL3018); document why this dev/test-only image stays root (tc traffic-shaping needs CAP_NET_ADMIN at runtime). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A trivy config scan (Dockerfile misconfiguration checks, distinct from hadolint) surfaced 17 findings across this repo's Dockerfiles. Most are false positives once you know the build topology: - develop.Dockerfile's unpinned "temporaliotest/auto-setup:latest": that registry has 6,728 tags, nearly all ephemeral per-commit CI SHAs with no stable channel to pin to -- ":latest" is the only sane default for local dev builds. - base-admin-tools.Dockerfile / base-server.Dockerfile flagged for running as root: these are build-only layers consumed via ARG by admin-tools.Dockerfile / server.Dockerfile, which immediately need root for addgroup/adduser before their own USER temporal. Adding USER here would break that. Both documented inline and suppressed via the new path-scoped .trivyignore.yaml (DS-0002 is a file-level check, so inline "trivy:ignore" comments don't work for it -- confirmed empirically). Deliberately NOT touched: base-builder.Dockerfile and base-ci-builder.Dockerfile also run as root and publish standalone to Docker Hub for external CI/dev use. Downstream consumers are unknown from this repo, so whether adding USER is safe needs a human call. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed?
server.Dockerfile:BASE_SERVER_IMAGE1.15.15->1.15.25, closing both CRITICAL OS-level CVEs and dropping HIGH findings from 23 to 5 (Alpine) and 36 to 8 (dockerizebinary), per verified trivy re-scan.admin-tools.Dockerfile/develop.Dockerfile: pinnedapk addpackage versions (bash-completion=2.17.0-r1,iproute2=6.17.0-r0).temporaliotest/server/temporaliotest/admin-toolsFROMlines are bake-injected build-context references, not registry pulls;develop.Dockerfileneeds to stay root fortctraffic-shaping at runtime.docker/base-images/base-admin-tools.Dockerfile/base-server.Dockerfile: documented why these build-only layers correctly have noUSER(downstream consumers need root foraddgroup/adduserbefore setting their own non-root user) and suppressed the resulting trivy false positive via a new path-scoped.trivyignore.yaml.Why?
Found via a Trivy vulnerability/misconfiguration scan of the built server image and the Dockerfiles in this repo. Full writeup (including what's intentionally left open) is in
temporal'sSECURITY_VULNERABILITY_REPORT.md.Deliberately not changed:
base-builder.Dockerfileandbase-ci-builder.Dockerfilealso run as root and are published standalone to Docker Hub for external CI/dev use. Adding a non-rootUSERlooks technically safe from what's in this file, but downstream consumers are unknown from this repo, so that's left as an open decision rather than applied.How did you test it?
serverimage target, rescanned with trivy/grype to confirm the CVE reduction, verified withhadolint)Potential risks
Base image bump could theoretically introduce new behavior from the newer Alpine/package versions, but this is a routine patch-version bump (
1.15.15->1.15.25) within the same major/minor line published by the same maintainers.