7d9a0748bf
The production Dockerfile already runs apk upgrade at build time. The helper and realtime Dockerfiles were missing this step. The helper (Alpine 3.21) ships with CVE-2025-15467 in OpenSSL 3.3.5. The realtime (Alpine 3.18) has outdated OpenSSL 3.1.2 with HIGH CVEs. Adding apk upgrade before apk add makes both images consistent with the production Dockerfile.
56 lines
2.9 KiB
Docker
56 lines
2.9 KiB
Docker
# Versions
|
|
# https://hub.docker.com/_/alpine
|
|
ARG BASE_IMAGE=alpine:3.21
|
|
# https://download.docker.com/linux/static/stable/
|
|
ARG DOCKER_VERSION=28.0.0
|
|
# https://github.com/docker/compose/releases
|
|
ARG DOCKER_COMPOSE_VERSION=2.38.2
|
|
# https://github.com/docker/buildx/releases
|
|
ARG DOCKER_BUILDX_VERSION=0.25.0
|
|
# https://github.com/buildpacks/pack/releases
|
|
ARG PACK_VERSION=0.38.2
|
|
# https://github.com/railwayapp/nixpacks/releases
|
|
ARG NIXPACKS_VERSION=1.41.0
|
|
# https://github.com/minio/mc/releases
|
|
ARG MINIO_VERSION=RELEASE.2025-08-13T08-35-41Z
|
|
|
|
|
|
FROM minio/mc:${MINIO_VERSION} AS minio-client
|
|
|
|
FROM ${BASE_IMAGE} AS base
|
|
|
|
ARG TARGETPLATFORM
|
|
ARG DOCKER_VERSION
|
|
ARG DOCKER_COMPOSE_VERSION
|
|
ARG DOCKER_BUILDX_VERSION
|
|
ARG PACK_VERSION
|
|
ARG NIXPACKS_VERSION
|
|
|
|
USER root
|
|
WORKDIR /artifacts
|
|
RUN apk upgrade --no-cache && \
|
|
apk add --no-cache bash curl git git-lfs openssh-client tar tini
|
|
RUN mkdir -p ~/.docker/cli-plugins
|
|
RUN if [[ ${TARGETPLATFORM} == 'linux/amd64' ]]; then \
|
|
curl -sSL https://github.com/docker/buildx/releases/download/v${DOCKER_BUILDX_VERSION}/buildx-v${DOCKER_BUILDX_VERSION}.linux-amd64 -o ~/.docker/cli-plugins/docker-buildx && \
|
|
curl -sSL https://github.com/docker/compose/releases/download/v${DOCKER_COMPOSE_VERSION}/docker-compose-linux-x86_64 -o ~/.docker/cli-plugins/docker-compose && \
|
|
(curl -sSL https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz | tar -C /usr/bin/ --no-same-owner -xzv --strip-components=1 docker/docker) && \
|
|
(curl -sSL https://github.com/buildpacks/pack/releases/download/v${PACK_VERSION}/pack-v${PACK_VERSION}-linux.tgz | tar -C /usr/local/bin/ --no-same-owner -xzv pack) && \
|
|
curl -sSL https://nixpacks.com/install.sh | bash && \
|
|
chmod +x ~/.docker/cli-plugins/docker-compose /usr/bin/docker /usr/local/bin/pack /root/.docker/cli-plugins/docker-buildx \
|
|
;fi
|
|
|
|
RUN if [[ ${TARGETPLATFORM} == 'linux/arm64' ]]; then \
|
|
curl -sSL https://github.com/docker/buildx/releases/download/v${DOCKER_BUILDX_VERSION}/buildx-v${DOCKER_BUILDX_VERSION}.linux-arm64 -o ~/.docker/cli-plugins/docker-buildx && \
|
|
curl -sSL https://github.com/docker/compose/releases/download/v${DOCKER_COMPOSE_VERSION}/docker-compose-linux-aarch64 -o ~/.docker/cli-plugins/docker-compose && \
|
|
(curl -sSL https://download.docker.com/linux/static/stable/aarch64/docker-${DOCKER_VERSION}.tgz | tar -C /usr/bin/ --no-same-owner -xzv --strip-components=1 docker/docker) && \
|
|
(curl -sSL https://github.com/buildpacks/pack/releases/download/v${PACK_VERSION}/pack-v${PACK_VERSION}-linux-arm64.tgz | tar -C /usr/local/bin/ --no-same-owner -xzv pack) && \
|
|
curl -sSL https://nixpacks.com/install.sh | bash && \
|
|
chmod +x ~/.docker/cli-plugins/docker-compose /usr/bin/docker /usr/local/bin/pack /root/.docker/cli-plugins/docker-buildx \
|
|
;fi
|
|
|
|
COPY --from=minio-client /usr/bin/mc /usr/bin/mc
|
|
RUN chmod +x /usr/bin/mc
|
|
|
|
ENTRYPOINT ["/sbin/tini", "--"]
|
|
CMD ["tail", "-f", "/dev/null"]
|