search

docker-library / php

Docker Official Image packaging for PHP
https://php.net
MIT License
3.79k stars 2k forks source link

apk update for persistent deps #1404

Closed mostafa-rz closed 1 year ago

mostafa-rz commented 1 year ago

Hi, Can you please explain why the repo is not updated(apk update) before adding the persistence deps? In the Alpine packages repo, OpenSSL is now updated and there are no vulnerabilities anymore, but I will get a vulnerability because php fpm is not adding the latest OpenSSL version.

tianon commented 1 year ago

We don't do an explicit apk update there because apk add --no-cache implies it (but with the added behavior that it then prunes the updated package lists afterwards so that they don't end up in the final image).