rosslh/coolify
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): add apk upgrade to helper and realtime Dockerfiles

Browse source 
The production Dockerfile already runs apk upgrade at build time.
The helper and realtime Dockerfiles were missing this step.

The helper (Alpine 3.21) ships with CVE-2025-15467 in OpenSSL 3.3.5.
The realtime (Alpine 3.18) has outdated OpenSSL 3.1.2 with HIGH CVEs.

Adding apk upgrade before apk add makes both images consistent
with the production Dockerfile.
This commit is contained in:
Charles Dabard 2026-04-05 00:23:17 +02:00
parent ffb5045c6a
commit 7d9a0748bf
2 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
docker/coolify-helper/Dockerfile
View file

@ -28,7 +28,8 @@ ARG NIXPACKS_VERSION
USER root
WORKDIR /artifacts
RUN apk add --no-cache bash curl git git-lfs openssh-client tar tini
RUN apk upgrade --no-cache && \
apk add --no-cache bash curl git git-lfs openssh-client tar tini
RUN mkdir -p ~/.docker/cli-plugins
RUN if [[ ${TARGETPLATFORM} == 'linux/amd64' ]]; then \
curl -sSL https://github.com/docker/buildx/releases/download/v${DOCKER_BUILDX_VERSION}/buildx-v${DOCKER_BUILDX_VERSION}.linux-amd64 -o ~/.docker/cli-plugins/docker-buildx && \

3
docker/coolify-realtime/Dockerfile
View file

@ -10,7 +10,8 @@ ARG TARGETPLATFORM
ARG CLOUDFLARED_VERSION
WORKDIR /terminal
RUN apk add --no-cache openssh-client make g++ python3 curl
RUN apk upgrade --no-cache && \
apk add --no-cache openssh-client make g++ python3 curl
COPY docker/coolify-realtime/package.json ./
RUN npm i
RUN npm rebuild node-pty --update-binary