mirror of
https://github.com/stefanprodan/podinfo.git
synced 2026-08-18 11:46:36 +00:00
Cristian Leonte
a16da5812d
The published stefanprodan/podinfo:latest image (built 2026-06-18 on Alpine 3.23.4) has since accumulated real CVEs disclosed against its pinned OS packages: curl/libcurl (CVE-2026-5773, CVE-2026-6276, plus 6 medium-severity curl CVEs), c-ares (CVE-2026-33630), and libssl3/libcrypto3 (CVE-2026-45447, plus 4 medium-severity openssl CVEs). None of these are Go module vulnerabilities - govulncheck finds none - they're stale Alpine package versions baked into an old image build. Bumping to alpine:3.24 (currently 3.24.1) resolves all of them: built and scanned this image with Trivy, 0 vulnerabilities found across the Alpine packages and both Go binaries (podinfo, podcli). Also smoke tested the container serving /healthz. Fixes #502
44 lines
841 B
Docker
44 lines
841 B
Docker
FROM golang:1.26-alpine AS builder
|
|
|
|
ARG REVISION
|
|
|
|
RUN mkdir -p /podinfo/
|
|
|
|
WORKDIR /podinfo
|
|
|
|
COPY . .
|
|
|
|
RUN go mod download
|
|
|
|
RUN CGO_ENABLED=0 go build -ldflags "-s -w \
|
|
-X github.com/stefanprodan/podinfo/pkg/version.REVISION=${REVISION}" \
|
|
-a -o bin/podinfo cmd/podinfo/*
|
|
|
|
RUN CGO_ENABLED=0 go build -ldflags "-s -w \
|
|
-X github.com/stefanprodan/podinfo/pkg/version.REVISION=${REVISION}" \
|
|
-a -o bin/podcli cmd/podcli/*
|
|
|
|
FROM alpine:3.24
|
|
|
|
ARG BUILD_DATE
|
|
ARG VERSION
|
|
ARG REVISION
|
|
|
|
LABEL maintainer="stefanprodan"
|
|
|
|
RUN addgroup -S app \
|
|
&& adduser -S -G app app \
|
|
&& apk --no-cache add \
|
|
ca-certificates curl netcat-openbsd
|
|
|
|
WORKDIR /home/app
|
|
|
|
COPY --from=builder /podinfo/bin/podinfo .
|
|
COPY --from=builder /podinfo/bin/podcli /usr/local/bin/podcli
|
|
COPY ./ui ./ui
|
|
RUN chown -R app:app ./
|
|
|
|
USER app
|
|
|
|
CMD ["./podinfo"]
|