Open mefellows opened 3 years ago
Just a couple. Looks like I've added trivy to the pact-foundation one but not the dius one yet.
I was going to raise an issue for that - but if you're happy I'll just add it straight in.
So, I'm not sure how to get rid of the vulnerabilities. They're all OS level vulnerabilities, not Ruby gem ones. We're on the latest version of passenger phusion for Ruby 2.7, and we're already doing:
# Update OS as per https://github.com/phusion/passenger-docker#upgrading-the-operating-system-inside-the-container
RUN apt-get update && \
apt-get upgrade -y -o Dpkg::Options::="--force-confold" && \
apt-get -qy autoremove && \
apt-get clean && \
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
See: https://github.com/DiUS/pact_broker-docker/runs/1883720574?check_suite_focus=true#step:4:159
What else can we do to force an upgrade of EVERYTHING? Any thoughts @k-ong?
You managed to at least remove all of the HIGH vulnerabilities and over 100 MEDIUM - so we're on track, but Phusion does at least agree there are problems with the base image:
(via: http://phusion.github.io/baseimage-docker/)
Jokes aside, according to the trivy scan at least, there are no fixes for the remaining vulnerabilities. So, not sure how to move forward.
we could update the trivy scan to not fail the build unless there are high vulnerabilities and make a note to keep an eye on the remaining MEDIUMs? It's also possible that some of those dependencies aren't needed, but that could involve a lot of trial/error to find out.
I've updated it to trivy filesystem --severity HIGH,CRITICAL --ignore-unfixed
for now so we can actually get a release out.
That seems to have done the trick https://github.com/DiUS/pact_broker-docker/runs/1899455773?check_suite_focus=true#step:3:851
nice one, thanks Beth. Let's leave this open so if somebody comes along they can see it. It will no doubt fail when there is a fix for them, so we can close it off then.
Using trivvy to scan this container presents the following vulnerabilities: