From 741a209023202cb0be5864c7e0e62742fde1c897 Mon Sep 17 00:00:00 2001 From: Christian Haudum Date: Wed, 27 Nov 2024 11:31:42 +0100 Subject: [PATCH] chore!: Remove `wget` from Promtail docker image (#15101) The package has been added to the Docker image with PR #11711 with the intention to support the Docker healthcheck. However, to reduce the attack surface of our Docker images, we want to keep them as slim as possible. The current version of Promtail (3.3.0) for example contains a wget version with vulnerability [CVE-2024-38428](https://security-tracker.debian.org/tracker/CVE-2024-38428). The healthcheck can be achieved by other means, e.g. 1. Extend the `grafana/promtail` base image and add `wget` using `apt install wget` https://github.com/grafana/loki/issues/11590#issuecomment-2106037181 3. Use low-level `/dev/tcp/127.0.0.1:9080` to establish a connection and check the exit code https://github.com/grafana/loki/issues/11590#issuecomment-2333481326 Original discussion about adding wget https://github.com/grafana/loki/issues/11590 This may break someone's Docker compose installation, when they require on the `wget` powered health check. Signed-off-by: Christian Haudum (cherry picked from commit 2eea54692e25ef540b0f04b7d99cf5634fa755b2) --- clients/cmd/promtail/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clients/cmd/promtail/Dockerfile b/clients/cmd/promtail/Dockerfile index 58e05719ac1cd..57bd9e0b499dc 100644 --- a/clients/cmd/promtail/Dockerfile +++ b/clients/cmd/promtail/Dockerfile @@ -10,7 +10,7 @@ RUN make clean && make BUILD_IN_CONTAINER=false PROMTAIL_JOURNAL_ENABLED=true pr FROM debian:12.5-slim # tzdata required for the timestamp stage to work RUN apt-get update && \ - apt-get install -qy tzdata ca-certificates wget libsystemd-dev && \ + apt-get install -qy tzdata ca-certificates libsystemd-dev && \ rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml