ImreSamu
commented
11 months ago Thank you for raising this issue to the community's attention!
Currently, our Docker PostGIS repository:
- Is solely based on images from https://github.com/docker-library/postgres , maintained by Docker, Inc.
- Ensures the Docker PostGIS images are automatically regenerated every week on Monday. This is to incorporate any changes in the base PostgreSQL images or updates in Debian/Alpine packages, ensuring that updates are seamlessly integrated.
see: https://github.com/postgis/docker-postgis/blob/316065820b22da6a443614ceb2a75376c7853722/.github/workflows/main.yml#L7C3-L7C25
schedule: - cron: '15 5 * * 1'
We are open to any suggestions for enhancing security. Your help and ideas in this area are greatly appreciated.
In the Docker Library FAQ section titled : "Why does my security scanner show that an image has CVEs?" , there is additional information:
For more detail:
The Dockerfile for the postgis/postgis:16-3.4 image is located here: https://github.com/postgis/docker-postgis/blob/master/16-3.4/Dockerfile
As you can see, it is based on the postgres:16-bullseye image ( https://github.com/docker-library/postgres/blob/master/16/bullseye/Dockerfile ) which I assume may also include these issues. But please verify this!
You can find the discussions and resolutions regarding upstream Docker PostgreSQL issues at the following links:
- searching for
repo:docker-library/postgres trivyhttps://github.com/search?q=repo%3Adocker-library%2Fpostgres+trivy&type=issues - searching for
repo:docker-library/postgres CVEhttps://github.com/search?q=repo%3Adocker-library%2Fpostgres+CVE&type=issues
Please feel free to check these resources for further information.
drnextgis
I used Trivy to scan the
postgis/postgis:16-3.4image, and here are the findings: