Add vulnerability scanning of the image #351
Comments
|
Thank you for the report. There's a lot here for me to process; for instance I thought the tags were automatically rebuilt whenever any of the included/dependency images got updated. For another matter, a lot of the automated tools that I used to have access to through Docker Hub seem to be gone and moved to a more expensive service tier. So thank you for the report, and I apologize that I don't have an immediate response, but I will begin looking into this and see if I can get to the bottom of it. |
|
phpmyadmin 5.1.2 is out |
|
Yes, that's true. However, 5.1.3 will be released soon; in order to reduce the load on the folks who maintain the official Docker images we decided to delay the pull request to update the Docker image. As far as the "community" repository at phpmyadmin/phpmyadmin, the recent changes to Docker Hub's service tiers have impacted our ability to programmatically trigger builds, so we are evaluating whether we should discontinue that repository or what the best way is to adapt moving forward. In the mean time, you can use this repository directly to get the newer version if that's of critical importance. Thank you for pointing this out; it's a known issue. |
|
GitHub has his own Docker Registry without any limits. I maintain several projects and I release the Docker images in both registries with this GitHub Action. NOTE: With that file I building 2 Docker images (Alpine and Debian) for 8 OS architectures each one = 16 docker images. Then I publishing all of them in DockerHub and GHCR. 32 Docker images in total. https://hub.docker.com/r/ngosang/urbackup-exporter/tags |
williamdes
changed the title
|
I did run this today, except |
|
Hi @williamdes, is there any update on this? Scanning the current 5.2.1 container, there is still a high number of vulnabilities (based on my trivy scan): 5 Critical | 109 High | 380 Medium | 81 Low | 378 unassigned May you check, which components are being required for the build-process only and therefore can be removed from the container-image itself, after the build-process was successful? Especially the linux-libc-dev library having 688 vulnabilities, which is about 70% of all. Thx & Best |
|
I can kick off a rebuild of the Docker images again later today to
hopefully resolve these.
|
Can you confirm that you are using the Docker official repository |
|
Of course using the official one: Getting rid of the Apache and having a lightweight solution with nginx & php, being controlled by supervisor, may also be an option to get rid of all those dependencies: #346 |
@ibennetch it will not work for Docker official repo |
|
It seems to be a manual not very documented process But when I update my PR: docker-library/official-images#17398 |
Critical vulnerabilities in Docker image phpmyadmin:5.1.1
Maybe you should add a "vulnerability bot" or something to check that periodically.
https://github.com/anchore/grype
The text was updated successfully, but these errors were encountered: