Skip to content
This repository has been archived by the owner on May 14, 2020. It is now read-only.

Ensure Docker image can be built #1432

Closed
wants to merge 1 commit into from
Closed

Ensure Docker image can be built #1432

wants to merge 1 commit into from

Conversation

mhutter
Copy link

@mhutter mhutter commented May 28, 2019

Hi! This is a minimal PR to ensure the 3.1 branch can at least be built. This should help with #1420.

I know you're working on the 3.2 branch, but the 3.1 Tag on Docker Hub is horribly out of date and contains a lot of critical CVEs, which is kind of bad of r a security-related project.

Changes:

  • Use a base image tag that exists
  • /etc/apache2/modsecurity.d has been moved to /etc/modsecurity.d

@mhutter mhutter changed the title Ensure Docker image can be built [WIP] Ensure Docker image can be built May 28, 2019
@mhutter
Copy link
Author

mhutter commented May 28, 2019

Ah, I edited in some new issues, working on it...

The tag in owasp/modsecurity has been renamed, this commit updates the
Dockerfile accordingly.

However, since the directory structure has also been update in the
upstream image (/etc/apache2/modsecurity.d has been moved to
/etc/modsecurity.d), some more changes to the Dockerfile were necessary

Signed-off-by: Manuel Hutter <manuel@hutter.io>
@mhutter mhutter changed the title [WIP] Ensure Docker image can be built Ensure Docker image can be built May 28, 2019
@csanders-git
Copy link
Contributor

Thanks, i'll be taking a look at this today.

@csanders-git
Copy link
Contributor

couple issues here -- with where files are being put, I am going to open a PR for this that basis it off the v3.2 image

@bittner
Copy link
Contributor

bittner commented May 30, 2019

If you want, Chaim, we can take a look at what it would take to build a production-grade container image. This would be an image that:

  • has a small footprint
  • has a small attack surface (e.g. no other software installed than absolutely necessary)
  • is automatically updated once any of the base images or the CRS sources change

@csanders-git
Copy link
Contributor

moving modsec-docker to multi stage builds will go a LONG way to solving the first two. Honestly, until OWASP solves the dockerhub issue, I think this is where we should spend our energy :)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants