tegwick
2745cd7fdd
The pinned Alpine 3.24.1 image carries musl 1.2.6-r2 and zlib 1.3.2-r0. Both have HIGH fixes. The scan gate blocks the push until those floors are installed. Assistant: grok Assistant-Session: 01a1b5fd-0c33-7ba1-b383-53937d525595
64 lines
2.6 KiB
Docker
64 lines
2.6 KiB
Docker
# Sanctioned base — musl/Alpine, adopted 2026-09-06.
|
|
#
|
|
# Alpine carries no perl, which is where the Debian slim variant's three
|
|
# unfixable CRITICALs lived (CVE-2026-13221, CVE-2026-42496, CVE-2026-8376 in
|
|
# perl-base, no upstream fix). Debian slim scanned 3 CRITICAL / 51 HIGH / 56
|
|
# MEDIUM against this image's 0 / 7 / 1.
|
|
#
|
|
# pip is deliberately absent from the runtime stage: it is a build-time tool,
|
|
# it held every Python-layer finding, and a running approval service has no
|
|
# business installing packages. Do not add it back.
|
|
#
|
|
# Base is pinned by digest, never a tag. See docs/image-scan-2026-09-06.md.
|
|
|
|
FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a AS build
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PATH=/opt/venv/bin:$PATH
|
|
|
|
RUN python -m venv /opt/venv
|
|
|
|
WORKDIR /app
|
|
COPY pyproject.toml README.md ./
|
|
COPY approval_engine ./approval_engine
|
|
RUN pip install --no-cache-dir '.[serve]' \
|
|
&& rm -rf /opt/venv/bin/pip /opt/venv/bin/pip3 /opt/venv/bin/pip3.12 \
|
|
/opt/venv/lib/python3.12/site-packages/pip \
|
|
/opt/venv/lib/python3.12/site-packages/pip-*.dist-info \
|
|
/opt/venv/lib/python3.12/site-packages/setuptools \
|
|
/opt/venv/lib/python3.12/site-packages/setuptools-*.dist-info \
|
|
/opt/venv/lib/python3.12/site-packages/pkg_resources
|
|
|
|
FROM python:3.12-alpine@sha256:b64631e04e4920160c50fbe8d8df828f7f35f06f425cb44aa09bca53e708a35a
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
|
PYTHONUNBUFFERED=1 \
|
|
PATH=/opt/venv/bin:$PATH
|
|
|
|
# Packages are patched explicitly rather than left to the base's pinned
|
|
# versions. The pinned Alpine 3.24.1 ships libuuid 2.42.1-r0 (fixed in
|
|
# 2.42.3), musl 1.2.6-r2 (CVE-2026-107891, fixed in 1.2.6-r3) and zlib
|
|
# 1.3.2-r0 (CVE-2026-85091, fixed in 1.3.2-r1). Each floor is a minimum
|
|
# version, not a floating upgrade.
|
|
RUN apk add --no-cache \
|
|
'libuuid>=2.42.3-r1' \
|
|
'musl>=1.2.6-r3' \
|
|
'musl-utils>=1.2.6-r3' \
|
|
'zlib>=1.3.2-r1' \
|
|
&& addgroup -S -g 10001 approval \
|
|
&& adduser -S -u 10001 -G approval -H approval \
|
|
&& rm -rf /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \
|
|
/usr/local/lib/python3.12/site-packages/pip \
|
|
/usr/local/lib/python3.12/site-packages/pip-*.dist-info \
|
|
/usr/local/lib/python3.12/site-packages/setuptools \
|
|
/usr/local/lib/python3.12/site-packages/setuptools-*.dist-info \
|
|
/usr/local/lib/python3.12/site-packages/pkg_resources
|
|
|
|
COPY --from=build /opt/venv /opt/venv
|
|
|
|
WORKDIR /app
|
|
USER 10001:10001
|
|
EXPOSE 8080
|
|
ENTRYPOINT ["approval-engine"]
|
|
CMD ["serve", "--help"]
|