Repository navigation
fix: patch base image CVEs and let Dependabot track it - #140
Merged
Merged
Conversation
The image scan failed on CVE-2026-111497 (critical, brotli-libs 1.2.0-r0, fixed in 1.2.1-r0). The pinned nginx-unprivileged:1.29-alpine tag has not been rebuilt upstream since May, and even the current 1.31-alpine still ships the vulnerable package; Alpine has the fix. - Bump the base to nginx-unprivileged:1.31-alpine (Alpine 3.24), pinned by digest. - Run `apk upgrade --no-cache` as root, then drop back to UID 101, so Alpine security fixes land without waiting for an upstream rebuild. - Add the docker ecosystem to Dependabot. The Dockerfile already said Dependabot bumps the tag, but nothing did, which is how the base went stale. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
oto-macenauer-absa
added a commit
that referenced
this pull request
Nov 6, 2026
## Problem Since #140 the image build runs `apk upgrade`, which fetches from `https://dl-cdn.alpinelinux.org`. Behind a TLS-intercepting corporate proxy it fails with `TLS: server certificate not trusted` (exit 99): the proxy re-signs with a corporate CA the base image does not trust. ## Fix Same pattern as AbsaOSS/EventGate's Dockerfile: - `ARG TRUSTED_SSL_CERTS=./trusted_certs` + `COPY` into `/opt/certs/`; every `*.pem`/`*.crt` there is appended to `/etc/ssl/certs/ca-certificates.crt` before `apk upgrade`. - `trusted_certs/` is committed empty (`.gitkeep`; everything else gitignored), so a plain `docker build` is unchanged. - `build-image.yml` takes an optional `ca-certificates` secret (PEM) and writes it to `trusted_certs/` before building. - `contract/DEPLOYMENT.md` documents it under *Private networks*. Notes: the certificate file stays at `/opt/certs/` in the image. The `ca-certificates` package upgrade regenerates the system bundle, so the shipped bundle is the stock one. ## Verification (local) - apk trusts exactly the OpenSSL default bundle: with a single unrelated CA it fails with the same `server certificate not trusted`. - Build with empty `trusted_certs/`: succeeds. - Build with a cert dropped in (no trailing newline): appended, upgrade succeeds. - `private-registry.spec.js`, `nginx-config.spec.js` pass. - Not yet tested behind the real corporate proxy. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The
Image build + integration + scanjob fails on every branch, including #139, because Trivy reports a critical CVE in the runtime base image:brotli-libsThe pinned
nginx-unprivileged:1.29-alpinetag has not been rebuilt since May. Even the current1.31-alpineimage still ships the vulnerable package; the fix is only in the Alpine repositories so far.Changes
Dockerfile:nginx-unprivileged:1.31-alpine(nginx 1.31.7, Alpine 3.24), still pinned by digest.apk upgrade --no-cacheas root, then switch back to UID 101. Alpine security fixes then land without waiting for an upstream rebuild..github/dependabot.yml: add thedockerecosystem. The Dockerfile comment said Dependabot bumps the tag, but no ecosystem was configured, which is how the base image went stale.Verification
Run locally against the image built from this branch:
npm run test:container: 37 passed against the real image.--severity CRITICAL,HIGH --ignore-unfixed: 0 findings. Before this change, the old image had 1 critical finding, and plain1.31-alpinehad 8 (1 critical, 7 high).uid=101(nginx).🤖 Generated with Claude Code