feat: remove Jython's pip from images (#1176)

JanssenProject · Apr 6, 2022 · e3f374f · e3f374f
1 parent d8e97c4
commit e3f374f
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/docker-jans-auth-server/Dockerfile b/docker-jans-auth-server/Dockerfile
@@ -48,6 +48,9 @@ RUN wget -q https://github.com/fabioz/PyDev.Debugger/archive/refs/tags/pydev_deb
     && /opt/jython/bin/pip install . \
     && rm -rf /tmp/pydev_debugger* /tmp/PyDev.Debugger-*
 
+# uninstall Jython pip and easy_install to reduce vulnerabilities
+RUN /opt/jython/bin/pip uninstall -y pip
+
 # ===========
 # Auth server
 # ===========

diff --git a/docker-jans-scim/Dockerfile b/docker-jans-scim/Dockerfile
@@ -38,7 +38,7 @@ EXPOSE 8080
 ARG JYTHON_VERSION=2.7.3
 RUN wget -q https://ox.gluu.org/maven/org/gluufederation/jython-installer/${JYTHON_VERSION}/jython-installer-${JYTHON_VERSION}.jar -O /tmp/jython-installer.jar \
     && mkdir -p /opt/jython \
-    && java -jar /tmp/jython-installer.jar -v -s -d /opt/jython \
+    && java -jar /tmp/jython-installer.jar -v -s -d /opt/jython -e ensurepip \
     && rm -f /tmp/jython-installer.jar /tmp/*.properties
 
 # ====