From a16da5812d422dedfa8bea955df846607e8a2043 Mon Sep 17 00:00:00 2001 From: Cristian Leonte Date: Mon, 20 Jul 2026 12:20:09 +0300 Subject: [PATCH] build: bump base image from alpine:3.23 to alpine:3.24 The published stefanprodan/podinfo:latest image (built 2026-06-18 on Alpine 3.23.4) has since accumulated real CVEs disclosed against its pinned OS packages: curl/libcurl (CVE-2026-5773, CVE-2026-6276, plus 6 medium-severity curl CVEs), c-ares (CVE-2026-33630), and libssl3/libcrypto3 (CVE-2026-45447, plus 4 medium-severity openssl CVEs). None of these are Go module vulnerabilities - govulncheck finds none - they're stale Alpine package versions baked into an old image build. Bumping to alpine:3.24 (currently 3.24.1) resolves all of them: built and scanned this image with Trivy, 0 vulnerabilities found across the Alpine packages and both Go binaries (podinfo, podcli). Also smoke tested the container serving /healthz. Fixes #502 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 3b5ee2e..c7cc77b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -18,7 +18,7 @@ RUN CGO_ENABLED=0 go build -ldflags "-s -w \ -X github.com/stefanprodan/podinfo/pkg/version.REVISION=${REVISION}" \ -a -o bin/podcli cmd/podcli/* -FROM alpine:3.23 +FROM alpine:3.24 ARG BUILD_DATE ARG VERSION