build: bump base image from alpine:3.23 to alpine:3.24

mirror of https://github.com/stefanprodan/podinfo.git synced 2026-08-19 04:06:27 +00:00

The published stefanprodan/podinfo:latest image (built 2026-06-18 on
Alpine 3.23.4) has since accumulated real CVEs disclosed against its
pinned OS packages: curl/libcurl (CVE-2026-5773, CVE-2026-6276, plus
6 medium-severity curl CVEs), c-ares (CVE-2026-33630), and
libssl3/libcrypto3 (CVE-2026-45447, plus 4 medium-severity openssl
CVEs). None of these are Go module vulnerabilities - govulncheck finds
none - they're stale Alpine package versions baked into an old image
build.

Bumping to alpine:3.24 (currently 3.24.1) resolves all of them: built
and scanned this image with Trivy, 0 vulnerabilities found across the
Alpine packages and both Go binaries (podinfo, podcli). Also smoke
tested the container serving /healthz.

Fixes #502

This commit is contained in:

Cristian Leonte

2026-07-20 12:20:09 +03:00

parent 46b93c8700

commit a16da5812d

1 changed files with 1 additions and 1 deletions

									
										Dockerfile
									
		+1
		-1
	
												View File
												
				@@ -18,7 +18,7 @@ RUN CGO_ENABLED=0 go build -ldflags "-s -w \

				    -X github.com/stefanprodan/podinfo/pkg/version.REVISION=${REVISION}" \

				    -a -o bin/podcli cmd/podcli/*

				FROM alpine:3.23

				FROM alpine:3.24

				ARG BUILD_DATE

				ARG VERSION