Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[container] Offer debian variants for dotnet images #1490

Open
prabhu opened this issue Dec 16, 2024 · 0 comments
Open

[container] Offer debian variants for dotnet images #1490

prabhu opened this issue Dec 16, 2024 · 0 comments
Labels
mode:container security

Comments

@prabhu
Copy link
Collaborator

prabhu commented Dec 16, 2024

We currently use the suse bci images for the custom container images.

https://github.com/CycloneDX/cdxgen/blob/master/ci/base-images/sle/Dockerfile.dotnet8#L1

For whatever reason, suse is not updating these images on a regular basis even if there are known CVEs against them. For example, dotnet version is still 8.0.10 instead of 8.0.11 and the sdk version is 8.0.403 instead of 8.0.404.

❯ docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -w /app --pull=always -it registry.suse.com/bci/dotnet-sdk:8.0 dotnet --version
8.0: Pulling from bci/dotnet-sdk
Digest: sha256:7aa51e54e3512ecf648e53e448a46b9fea74c03f66090c84c7285911c53d83a0
Status: Image is up to date for registry.suse.com/bci/dotnet-sdk:8.0
8.0.403
❯ docker inspect registry.suse.com/bci/dotnet-sdk:8.0
[
    {
        "Id": "sha256:099ff01e8f696321979eb453e907c70c84c49cd07f820dda4dab9f56130bbf2f",
        "RepoTags": [
            "registry.suse.com/bci/dotnet-sdk:8.0"
        ],
        "RepoDigests": [
            "registry.suse.com/bci/dotnet-sdk@sha256:7aa51e54e3512ecf648e53e448a46b9fea74c03f66090c84c7285911c53d83a0"
        ],
        "Parent": "",
        "Comment": "merge sha256:179afe6e69ba36f7f95c3b45b36ba1feabbca364b3e70afb9e1fa32fe8bd08dc to sha256:261261704fc105f45aca864854a1678b456e363932948dd1f922f408023ada7f",
        "Created": "2024-12-11T13:46:45.023219731Z",
        "Container": "263a0282c8d095cbaa953a328d3d0d718435b5c826eee809264604bc8bddae01",
        "ContainerConfig": {
            "Hostname": "h01-ch4d",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "DOTNET_CLI_TELEMETRY_OPTOUT=1"
            ],
            "Cmd": [
                "/bin/sh",
                "-c",
                "#(nop) ",
                "LABEL org.openbuildservice.disturl=obs://build.suse.de/SUSE:SLE-15-SP6:Update:CR/containers/0ef76ff136928d88b04edeb5e0148b51-dotnet-8.0"
            ],
            "Image": "sha256:073379c01b529b0deda67671698f4873b08865878f566a9f1b714e21aa54bee0",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": null,
            "OnBuild": null,
            "Labels": {
                "com.suse.bci.base.authors": "https://github.com/SUSE/bci/discussions",
                "com.suse.bci.base.created": "2024-12-11T09:09:43.395255971Z",
                "com.suse.bci.base.description": "Image for containers based on SUSE Linux Enterprise Server 15 SP6.",
                "com.suse.bci.base.disturl": "obs://build.suse.de/SUSE:SLE-15-SP6:Update:CR/images/9c71906924d51fe4f4fde490b94383dd-sles15-image",
                "com.suse.bci.base.eula": "sle-bci",
                "com.suse.bci.base.lifecycle-url": "https://www.suse.com/lifecycle#suse-linux-enterprise-server-15",
                "com.suse.bci.base.name": "15.6.47.14.5",
                "com.suse.bci.base.reference": "registry.suse.com/bci/bci-base:15.6.47.14.5",
                "com.suse.bci.base.release-stage": "released",
                "com.suse.bci.base.source": "https://sources.suse.com/SUSE:SLE-15-SP6:Update:CR/sles15-image/9c71906924d51fe4f4fde490b94383dd/",
                "com.suse.bci.base.supportlevel": "l3",
                "com.suse.bci.base.title": "SLE BCI 15 SP6 Base",
                "com.suse.bci.base.url": "https://www.suse.com/products/base-container-images/",
                "com.suse.bci.base.vendor": "SUSE LLC",
                "com.suse.bci.base.version": "15.6.47.14.5",
                "com.suse.bci.dotnet.sdk.authors": "https://github.com/SUSE/bci/discussions",
                "com.suse.bci.dotnet.sdk.created": "2024-12-11T13:46:18.988834530Z",
                "com.suse.bci.dotnet.sdk.description": "The .NET SDK 8.0 based on the SLE Base Container Image. The .NET packages contained in this image come from a 3rd-party repository http://packages.microsoft.com. You can find the respective source code in https://github.com/dotnet. SUSE doesn't provide any support or warranties.",
                "com.suse.bci.dotnet.sdk.disturl": "obs://build.suse.de/SUSE:SLE-15-SP6:Update:CR/containers/0ef76ff136928d88b04edeb5e0148b51-dotnet-8.0",
                "com.suse.bci.dotnet.sdk.eula": "sle-bci",
                "com.suse.bci.dotnet.sdk.lifecycle-url": "https://www.suse.com/lifecycle#suse-linux-enterprise-server-15",
                "com.suse.bci.dotnet.sdk.name": "8.0.10-45.6",
                "com.suse.bci.dotnet.sdk.reference": "registry.suse.com/bci/dotnet-sdk:8.0.10-45.6",
                "com.suse.bci.dotnet.sdk.release-stage": "released",
                "com.suse.bci.dotnet.sdk.source": "https://sources.suse.com/SUSE:SLE-15-SP6:Update:CR/dotnet-8.0/0ef76ff136928d88b04edeb5e0148b51/",
                "com.suse.bci.dotnet.sdk.supportlevel": "techpreview",
                "com.suse.bci.dotnet.sdk.title": "SLE BCI .NET SDK 8.0",
                "com.suse.bci.dotnet.sdk.until": "2026-11-10",
                "com.suse.bci.dotnet.sdk.url": "https://www.suse.com/products/base-container-images/",
                "com.suse.bci.dotnet.sdk.vendor": "SUSE LLC",
                "com.suse.bci.dotnet.sdk.version": "8.0.10",
                "com.suse.eula": "sle-bci",
                "com.suse.lifecycle-url": "https://www.suse.com/lifecycle#suse-linux-enterprise-server-15",
                "com.suse.release-stage": "released",
                "com.suse.supportlevel": "techpreview",
                "com.suse.supportlevel.until": "2026-11-10",
                "io.artifacthub.package.logo-url": "https://opensource.suse.com/bci/SLE_BCI_logomark_green.svg",
                "io.artifacthub.package.readme-url": "https://sources.suse.com/SUSE:SLE-15-SP6:Update:CR/dotnet-8.0/0ef76ff136928d88b04edeb5e0148b51//README.md",
                "org.openbuildservice.disturl": "obs://build.suse.de/SUSE:SLE-15-SP6:Update:CR/containers/0ef76ff136928d88b04edeb5e0148b51-dotnet-8.0",
                "org.opencontainers.image.authors": "https://github.com/SUSE/bci/discussions",
                "org.opencontainers.image.base.digest": "sha256:834a6b0884e5fc32fceb8698b707d117eb8a7a85de76680a8737529430ecdfc2",
                "org.opencontainers.image.base.name": "registry.suse.com/bci/bci-base:15.6",
                "org.opencontainers.image.created": "2024-12-11T13:46:18.988834530Z",
                "org.opencontainers.image.description": "The .NET SDK 8.0 based on the SLE Base Container Image. The .NET packages contained in this image come from a 3rd-party repository http://packages.microsoft.com. You can find the respective source code in https://github.com/dotnet. SUSE doesn't provide any support or warranties.",
                "org.opencontainers.image.ref.name": "8.0.10-45.6",
                "org.opencontainers.image.source": "https://sources.suse.com/SUSE:SLE-15-SP6:Update:CR/dotnet-8.0/0ef76ff136928d88b04edeb5e0148b51/",
                "org.opencontainers.image.title": "SLE BCI .NET SDK 8.0",
                "org.opencontainers.image.url": "https://www.suse.com/products/base-container-images/",
                "org.opencontainers.image.vendor": "SUSE LLC",
                "org.opencontainers.image.version": "8.0.10",
                "org.opensuse.reference": "registry.suse.com/bci/dotnet-sdk:8.0.10-45.6"
            }
        },
        "DockerVersion": "25.0.6-ce",
        "Author": "",
        "Config": {
            "Hostname": "",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "DOTNET_CLI_TELEMETRY_OPTOUT=1"
            ],
            "Cmd": [
                "/bin/bash"
            ],
            "Image": "sha256:073379c01b529b0deda67671698f4873b08865878f566a9f1b714e21aa54bee0",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": null,
            "OnBuild": null,
            "Labels": {
                "com.suse.bci.base.authors": "https://github.com/SUSE/bci/discussions",
                "com.suse.bci.base.created": "2024-12-11T09:09:43.395255971Z",
                "com.suse.bci.base.description": "Image for containers based on SUSE Linux Enterprise Server 15 SP6.",
                "com.suse.bci.base.disturl": "obs://build.suse.de/SUSE:SLE-15-SP6:Update:CR/images/9c71906924d51fe4f4fde490b94383dd-sles15-image",
                "com.suse.bci.base.eula": "sle-bci",
                "com.suse.bci.base.lifecycle-url": "https://www.suse.com/lifecycle#suse-linux-enterprise-server-15",
                "com.suse.bci.base.name": "15.6.47.14.5",
                "com.suse.bci.base.reference": "registry.suse.com/bci/bci-base:15.6.47.14.5",
                "com.suse.bci.base.release-stage": "released",
                "com.suse.bci.base.source": "https://sources.suse.com/SUSE:SLE-15-SP6:Update:CR/sles15-image/9c71906924d51fe4f4fde490b94383dd/",
                "com.suse.bci.base.supportlevel": "l3",
                "com.suse.bci.base.title": "SLE BCI 15 SP6 Base",
                "com.suse.bci.base.url": "https://www.suse.com/products/base-container-images/",
                "com.suse.bci.base.vendor": "SUSE LLC",
                "com.suse.bci.base.version": "15.6.47.14.5",
                "com.suse.bci.dotnet.sdk.authors": "https://github.com/SUSE/bci/discussions",
                "com.suse.bci.dotnet.sdk.created": "2024-12-11T13:46:18.988834530Z",
                "com.suse.bci.dotnet.sdk.description": "The .NET SDK 8.0 based on the SLE Base Container Image. The .NET packages contained in this image come from a 3rd-party repository http://packages.microsoft.com. You can find the respective source code in https://github.com/dotnet. SUSE doesn't provide any support or warranties.",
                "com.suse.bci.dotnet.sdk.disturl": "obs://build.suse.de/SUSE:SLE-15-SP6:Update:CR/containers/0ef76ff136928d88b04edeb5e0148b51-dotnet-8.0",
                "com.suse.bci.dotnet.sdk.eula": "sle-bci",
                "com.suse.bci.dotnet.sdk.lifecycle-url": "https://www.suse.com/lifecycle#suse-linux-enterprise-server-15",
                "com.suse.bci.dotnet.sdk.name": "8.0.10-45.6",
                "com.suse.bci.dotnet.sdk.reference": "registry.suse.com/bci/dotnet-sdk:8.0.10-45.6",
                "com.suse.bci.dotnet.sdk.release-stage": "released",
                "com.suse.bci.dotnet.sdk.source": "https://sources.suse.com/SUSE:SLE-15-SP6:Update:CR/dotnet-8.0/0ef76ff136928d88b04edeb5e0148b51/",
                "com.suse.bci.dotnet.sdk.supportlevel": "techpreview",
                "com.suse.bci.dotnet.sdk.title": "SLE BCI .NET SDK 8.0",
                "com.suse.bci.dotnet.sdk.until": "2026-11-10",
                "com.suse.bci.dotnet.sdk.url": "https://www.suse.com/products/base-container-images/",
                "com.suse.bci.dotnet.sdk.vendor": "SUSE LLC",
                "com.suse.bci.dotnet.sdk.version": "8.0.10",
                "com.suse.eula": "sle-bci",
                "com.suse.lifecycle-url": "https://www.suse.com/lifecycle#suse-linux-enterprise-server-15",
                "com.suse.release-stage": "released",
                "com.suse.supportlevel": "techpreview",
                "com.suse.supportlevel.until": "2026-11-10",
                "io.artifacthub.package.logo-url": "https://opensource.suse.com/bci/SLE_BCI_logomark_green.svg",
                "io.artifacthub.package.readme-url": "https://sources.suse.com/SUSE:SLE-15-SP6:Update:CR/dotnet-8.0/0ef76ff136928d88b04edeb5e0148b51//README.md",
                "org.openbuildservice.disturl": "obs://build.suse.de/SUSE:SLE-15-SP6:Update:CR/containers/0ef76ff136928d88b04edeb5e0148b51-dotnet-8.0",
                "org.opencontainers.image.authors": "https://github.com/SUSE/bci/discussions",
                "org.opencontainers.image.base.digest": "sha256:834a6b0884e5fc32fceb8698b707d117eb8a7a85de76680a8737529430ecdfc2",
                "org.opencontainers.image.base.name": "registry.suse.com/bci/bci-base:15.6",
                "org.opencontainers.image.created": "2024-12-11T13:46:18.988834530Z",
                "org.opencontainers.image.description": "The .NET SDK 8.0 based on the SLE Base Container Image. The .NET packages contained in this image come from a 3rd-party repository http://packages.microsoft.com. You can find the respective source code in https://github.com/dotnet. SUSE doesn't provide any support or warranties.",
                "org.opencontainers.image.ref.name": "8.0.10-45.6",
                "org.opencontainers.image.source": "https://sources.suse.com/SUSE:SLE-15-SP6:Update:CR/dotnet-8.0/0ef76ff136928d88b04edeb5e0148b51/",
                "org.opencontainers.image.title": "SLE BCI .NET SDK 8.0",
                "org.opencontainers.image.url": "https://www.suse.com/products/base-container-images/",
                "org.opencontainers.image.vendor": "SUSE LLC",
                "org.opencontainers.image.version": "8.0.10",
                "org.opensuse.reference": "registry.suse.com/bci/dotnet-sdk:8.0.10-45.6"
            }
        },
        "Architecture": "amd64",
        "Os": "linux",
        "Size": 750648846,
        "VirtualSize": 750648846,
        "GraphDriver": {
            "Data": {
                "LowerDir": "/home/almalinux/.local/share/docker/overlay2/4d8e1df3b60f6107defc75a7bdd7e69418b55b0dd7df6aba44dbc1ded3936846/diff",
                "MergedDir": "/home/almalinux/.local/share/docker/overlay2/6db4ddbf745534be5dff830d45a334c46c3fd27f202be12815dafc480a93b625/merged",
                "UpperDir": "/home/almalinux/.local/share/docker/overlay2/6db4ddbf745534be5dff830d45a334c46c3fd27f202be12815dafc480a93b625/diff",
                "WorkDir": "/home/almalinux/.local/share/docker/overlay2/6db4ddbf745534be5dff830d45a334c46c3fd27f202be12815dafc480a93b625/work"
            },
            "Name": "overlay2"
        },
        "RootFS": {
            "Type": "layers",
            "Layers": [
                "sha256:58974debbb45f4d87e576f17a4ab8eb048d488e4465beb88eea5c70ef8bf194b",
                "sha256:9b7ea39b6933fcc4335a925e3ba14f0116452bab4f06316f9f4378a06ac2a4fd"
            ]
        },
        "Metadata": {
            "LastTagTime": "0001-01-01T00:00:00Z"
        }
    }
]

In contrast, the official images including debian are getting updated regularly.

docker run --rm -v /tmp:/tmp -v $(pwd):/app:rw -w /app --pull=always -it mcr.microsoft.com/dotnet/sdk:8.0 dotnet --version
8.0: Pulling from dotnet/sdk
Digest: sha256:032381bcea86fa0a408af5df63a930f1ff5b03116c940a7cd744d3b648e66749
Status: Image is up to date for mcr.microsoft.com/dotnet/sdk:8.0
8.0.404
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
mode:container security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@prabhu