Reduce image CVEs by switching to minimal base and cleanup build chain#19
Reduce image CVEs by switching to minimal base and cleanup build chain#19talkraghu wants to merge 2 commits intopiraeusdatastore:mainfrom
Conversation
Signed-off-by: Raghavendra K <raghavendra.k@nokia.com>
24dcf16 to
8237adc
Compare
Signed-off-by: Raghavendra K <raghavendra.k@nokia.com>
711b82b to
52cfdca
Compare
|
With this change, the scan on the docker image shows NO critical CVE's There are a few HIGH CVE's though (listed below) (which should be fine) |
Summary
This PR improves the build reproducibility and mitigates potential risk from upstream CVEs by switching the base build image from gcc:latest to gcc:13.
Background
The previous Dockerfile used gcc:latest as the base image for building DRBD utilities. Using a floating tag can inadvertently introduce new vulnerabilities over time and lead to unpredictable build behavior. Pinning the image to gcc:13 ensures a stable, auditable, and more secure build environment.
Testing Performed
Rebuilt the image locally with gcc:13.
Scanned using grype: 0 Critical CVEs and 9 High CVEs, all originating from libxml2 and python3 in the UBI 9 runtime base image.
Functional verification:
drbd-shutdown-guard --help displays usage correctly.
drbd-shutdown-guard's initcontainer at satellite-node pod is completing well.