From 0cd401d98955040988367ae7f2bb5a76189a7919 Mon Sep 17 00:00:00 2001 From: Bryan Paget <8212170+bryanpaget@users.noreply.github.com> Date: Fri, 13 Sep 2024 11:06:35 -0700 Subject: [PATCH] update(security): Ubuntu to alpine, update go pkgs (#6) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * update(security): Ubuntu to alpine, update go pkgs The Ubuntu image had some vulnerablities and the easiest way to fix it was to switch to alpine. This results in a smaller image with fewer attack surfaces. Since this is a small image with a single application it makes sense to use a small base. I've also updated some of the go packages, see the diff. * update(security): Ubuntu to alpine, update go pkgs The Ubuntu image had some vulnerablities and the easiest way to fix it was to switch to alpine. This results in a smaller image with fewer attack surfaces. Since this is a small image with a single application it makes sense to use a small base. I've also updated some of the go packages, see the diff. * update(Dockerfile): add bash * update(Dockerfile): add missing packages * update(Dockerfile): modify symlink * add apk upgrade to fix alpine cves Some new CVEs have popped up but adding apk update && apk upgrade to the Dockerfile ensures we are using the latest and most secure packages. goofys (alpine 3.20.2) Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0) ┌────────────┬───────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├────────────┼───────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────┤ │ libcrypto3 │ CVE-2024-6119 │ MEDIUM │ fixed │ 3.3.1-r3 │ 3.3.2-r0 │ Issue summary: Applications performing certificate name │ │ │ │ │ │ │ │ checks (e.g., ... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-6119 │ ├────────────┤ │ │ │ │ │ │ │ libssl3 │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ └────────────┴───────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────┘ * update(Dockerfile): pin alpine image version to 3.20.3 I've also reverted the script to use bash instead of sh since we installed bash for compatibility reasons. I've reverted the golang builder containers to use version 1.20.7 since we don't want to introduce new unknown issues. --------- Co-authored-by: Bryan Paget --- Dockerfile | 36 +- go.mod | 16 +- go.sum | 1367 ++++++++++++++++++++++++++++++++++++++++++++++++++-- 3 files changed, 1350 insertions(+), 69 deletions(-) diff --git a/Dockerfile b/Dockerfile index 9e31cd60..4b87636b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,29 +1,40 @@ -FROM golang:1.20.7 as fusermount3-proxy-builder +FROM golang:1.20.7-alpine AS fusermount3-proxy-builder + +# Install required build dependencies +RUN apk update && apk upgrade && apk --no-cache add make gcc g++ libc-dev fuse-dev WORKDIR /meta-fuse-csi-plugin ADD ./meta-fuse-csi-plugin . -# Builds the meta-fuse-csi-plugin app +# Build the fusermount3-proxy RUN make fusermount3-proxy BINDIR=/bin -FROM golang:1.20.7 as goofys-builder +FROM golang:1.20.7-alpine AS goofys-builder + +# Install required build dependencies +RUN apk update && apk upgrade && apk --no-cache add git make gcc g++ libc-dev fuse-dev WORKDIR /goofys ADD . . -# Builds the goofys app +# Build the goofys app RUN make build -FROM ubuntu:22.04 +# 3.20.3 is the latest as of this commit (September 09 2024) +FROM alpine:3.20.3 -RUN apt update && apt upgrade -y -RUN apt install -y ca-certificates wget libfuse2 fuse3 +# Install necessary runtime dependencies +RUN apk update && apk upgrade && apk --no-cache add ca-certificates bash wget -# prepare for MinIO -RUN wget https://dl.min.io/client/mc/release/linux-amd64/mc -O /usr/bin/mc && chmod +x /usr/bin/mc +# Download MinIO client (mc) +RUN wget https://dl.min.io/client/mc/release/linux-amd64/mc -O /usr/bin/mc && \ + chmod +x /usr/bin/mc && \ + apk del wget && rm -rf /var/cache/apk/* +# Copy the test file COPY <