4c9fa2436e
The production images built on mutable tags with --pull, so the same commit could produce different bases, and neither Dockerfile upgraded its OS packages even though the local ones did. The published API image carried 56 HIGH and 3 CRITICAL findings, 15 of them with an upstream fix available. Pin both bases by digest and upgrade OS packages in the production images. That removes all 3 CRITICAL and 13 of the 15 fixable findings. The remaining two, msgpack and setuptools, come from a third-party SBOM; neither package is importable or listed by pip in the built image, which I confirmed rather than taking the previous report's word for it. The web image could not be fixed this way: the official 1.28 line pins nginx=1.28.3-r1 in /etc/apk/world, so apk upgrade leaves five HIGH findings in place even though Alpine ships 1.28.3-r7. Moving to nginx:alpine (1.31.6) clears them completely; 1.29-alpine scans worse, at 37 HIGH. Same uid 101 and the same template entrypoint, and the local images now use the same pinned bases so the integration suite exercises what ships. Full suite passes on nginx 1.31.6, including the browser end-to-end. With both images at zero CRITICAL, the image scan now blocks on CRITICAL and reports HIGH, instead of reporting everything. PYTHON_BASE_IMAGE and NGINX_BASE_IMAGE are wired through to the builds so a base can move forward without editing the repository, which is what PORTAINER.md already promised. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
34 lines
1.7 KiB
Docker
34 lines
1.7 KiB
Docker
# syntax=docker/dockerfile:1
|
|
ARG PYTHON_BASE_IMAGE=python:3.12-slim@sha256:2f17fc044b579bab302c2e8054d3a686e2cb9a83de48e70534b94cd8ebbe06a9
|
|
# Both bases are pinned by digest; override with the repository variables to
|
|
# move them forward deliberately.
|
|
# nginx 1.31.6. The 1.28 line pins nginx=1.28.3-r1 in /etc/apk/world, so its five
|
|
# HIGH findings cannot be upgraded in place; 1.29 scans worse. This one is clean.
|
|
ARG NGINX_BASE_IMAGE=nginx:alpine@sha256:62ff2089abf5a9ed33bd232895bef5e22f7bb4b200675cec49a5ebc48e3d4ac8
|
|
FROM ${PYTHON_BASE_IMAGE} AS policy
|
|
WORKDIR /build
|
|
COPY dtf-site.html /build/dtf-site.html
|
|
COPY local /build/local
|
|
COPY deploy /build/deploy
|
|
ENV NGINX_TEMPLATE=/build/deploy/nginx.conf.template
|
|
RUN python local/compile_web.py
|
|
|
|
FROM ${NGINX_BASE_IMAGE}
|
|
# Same reason as the API image: a pinned base freezes its packages.
|
|
RUN apk upgrade --no-cache
|
|
ARG VCS_REF=unknown
|
|
LABEL org.opencontainers.image.title="DTF Site and Kanban" \
|
|
org.opencontainers.image.revision="$VCS_REF" \
|
|
org.opencontainers.image.source="DTF System repository"
|
|
ENV WEB_INDEX=index.html PUBLIC_HOST=invalid.example S3_PUBLIC_ENDPOINT=https://invalid.example
|
|
COPY --from=policy /build/default.conf.template /etc/nginx/templates/default.conf.template
|
|
COPY dtf-site.html /usr/share/nginx/html/index.html
|
|
COPY local/static/ /usr/share/nginx/html/
|
|
# The official entrypoint renders the server configuration at startup and Nginx
|
|
# writes its PID/cache files. Keep the service non-root while granting it
|
|
# ownership of only those runtime locations. This works in Docker Swarm,
|
|
# where the previous read-only/tmpfs combination was not mounted as expected.
|
|
RUN chown -R 101:101 /etc/nginx/conf.d /var/cache/nginx /run
|
|
USER 101:101
|
|
EXPOSE 8080
|