bethesque
commented
3 years ago Just a couple. Looks like I've added trivy to the pact-foundation one but not the dius one yet.
Open mefellows opened 3 years ago
bethesque
commented
3 years ago Just a couple. Looks like I've added trivy to the pact-foundation one but not the dius one yet.
mefellows
commented
3 years ago I was going to raise an issue for that - but if you're happy I'll just add it straight in.
bethesque
commented
3 years ago So, I'm not sure how to get rid of the vulnerabilities. They're all OS level vulnerabilities, not Ruby gem ones. We're on the latest version of passenger phusion for Ruby 2.7, and we're already doing:
# Update OS as per https://github.com/phusion/passenger-docker#upgrading-the-operating-system-inside-the-container
RUN apt-get update && \
apt-get upgrade -y -o Dpkg::Options::="--force-confold" && \
apt-get -qy autoremove && \
apt-get clean && \
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
See: https://github.com/DiUS/pact_broker-docker/runs/1883720574?check_suite_focus=true#step:4:159
What else can we do to force an upgrade of EVERYTHING? Any thoughts @k-ong?
mefellows
commented
3 years ago You managed to at least remove all of the HIGH vulnerabilities and over 100 MEDIUM - so we're on track, but Phusion does at least agree there are problems with the base image:
(via: http://phusion.github.io/baseimage-docker/)
Jokes aside, according to the trivy scan at least, there are no fixes for the remaining vulnerabilities. So, not sure how to move forward.
we could update the trivy scan to not fail the build unless there are high vulnerabilities and make a note to keep an eye on the remaining MEDIUMs? It's also possible that some of those dependencies aren't needed, but that could involve a lot of trial/error to find out.
bethesque
commented
3 years ago I've updated it to trivy filesystem --severity HIGH,CRITICAL --ignore-unfixed for now so we can actually get a release out.
bethesque
commented
3 years ago That seems to have done the trick https://github.com/DiUS/pact_broker-docker/runs/1899455773?check_suite_focus=true#step:3:851
mefellows
commented
3 years ago nice one, thanks Beth. Let's leave this open so if somebody comes along they can see it. It will no doubt fail when there is a fix for them, so we can close it off then.
Using trivvy to scan this container presents the following vulnerabilities: