search

nginxinc / docker-nginx

Official NGINX Dockerfiles
BSD 2-Clause "Simplified" License
3.27k stars 1.73k forks source link

Update stable to Alpine 3.20 #895

Closed jnoordsij closed 3 months ago

jnoordsij commented 6 months ago

Proposed changes

This is a follow-up to #894, given that in my eyes it seems most likely a new mainline release will precede a new stable release.

Updates the stable image to use Alpine 3.20 as default version. See also https://alpinelinux.org/posts/Alpine-3.20.0-released.html.

Note: given that this requires built binaries for the new Alpine version and won't take any effect until an actual new release of nginx itself, this PR is intentionally marked as draft, so it can function both as a heads-up about the new release and a place that allows for subscription to any potential updates. It can then be merged later at any convenient time when everything is ready. However, if it is still preferable to close this in the meantime, feel free to do so.

Checklist

Before creating a PR, run through this checklist and mark each as complete:

jnoordsij commented 5 months ago

Should be ready for 1.26.1 release once the Alpine binaries are available!

mycahjay commented 5 months ago

@jnoordsij are there any updates on this, or do you have an idea of when it might be ready? We're eager to move to Alpine 3.20, due to some vulnerabilities that exist on 3.19. Thanks for all you do!

chaitutheprince commented 5 months ago

@jnoordsij - We had a security vulnerability in the Alpine Linux image used in our environment, specifically related to BusyBox. The due date for addressing this issue is 06/19, and it poses a security risk that could impact our services. Could you please inform us when you plan to release an updated version of NGINX with the latest security updates?

jnoordsij commented 5 months ago

This PR is a community contribution; I have no official ties to it.

Regarding when to expect the Alpine update, this generally only coincides with a new release for this image, hence I do not expect this to be available before the 1.26.2 release (for which no release date is known, at least to me).

For any security issues on the Alpine image, these should be addressed in the base image, which should prompt a rebuild of the images here. For more details on this, please consult https://github.com/docker-library/faq?tab=readme-ov-file#why-does-my-security-scanner-show-that-an-image-has-cves.

mmoll commented 5 months ago

I think this PR only needs a rebase (and perhaps the addition of the curl package when building from source), then at least the CI should return green.

thresheek commented 3 months ago

Merged, thank you!