Closed alucard001 closed 2 months ago
If I am reading the report correctly, most of these vulnerabilities are related to system packages, and nothing to do with the base image. Git, for instance is needed for composer.
So unless you are installing composer packages or doing git operations, etc, during the normal course of production execution, these CVEs are meaningless to you. Most of these tools just tell you what exists, but you have to use your brain to figure out if they even mean anything to your application.
FWIW, there is no "secure" base image, there are just base images where we don't know what is insecure about them, yet. (For example, the latest ssh vulnerability was around for nearly 4 years before it was discovered).
We're rebuilding fresh images using fresh official PHP images every night. These CVE are false positives, and anyway, there are nothing we can do about them, this should be handled by Debian and/or PHP.
Describe you feature request
Is your feature request related to a problem? Please describe. While I am trying to deploy frankenphp to AWS using your docker image, in the Security report under ECR, I got the following:![image](https://github.com/dunglas/frankenphp/assets/1968244/8bce3b91-d8dc-4967-8ed8-b256fb32bce1)
Here is the Dockerfile I am currently using:
While I am reading some CVE report it seems that most of the vulnerabilities are solved when using Debian sid (or trixie), is it possible to switch the base OS to those systems?
Thank you very much.