Open hannes-ucsc opened 1 year ago
Security review: this change does introduce a newer version of a Docker images. That image will have significantly fewer vulnerabilities.
We won't have time for this. It's importance is lower, now that we decided that vulnerabilities in images used exclusively outside if the security boundary aren't subject to the FedRAMP mitigation timeline.
We currently use 0.9.4
built from this https://github.com/lmenezes/cerebro-docker/blob/master/Dockerfile
Fork that repo and modify the Dockerfile to harden the image. They are pushing to ghcr.io so their most recently built images are not on docker.io for some reason.
This process is similar to what we did for the pycharm image (fork, modify dockerfile, modify GH actions config, push to our org on docker.io).