Skip to content

chore(deps): update alpine docker tag to v3.24 #151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update alpine docker tag to v3.24 #151

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion curl/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM alpine:3.6
FROM alpine:3.24

RUN apk --no-cache add curl ca-certificates jq && \
update-ca-certificates
2 changes: 1 addition & 1 deletion docker-cleanup/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM alpine:3.5
FROM alpine:3.24

# Generic docker-cleanup tool
# Currently runs docker-gc & removes dangling volumes
Expand All @@ -7,7 +7,7 @@
# docker run -v/var/run/docker.sock:/var/run/docker.sock kiwicom/docker-cleanup

ARG DOCKER_VERSION=1.13.1
RUN apk --no-cache add bash curl tzdata && \

Check warning on line 10 in docker-cleanup/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[LOW] APK Package Version Not Pinned 

Details:
Installing packages without version pinning allows automatic updates that may
introduce breaking changes, vulnerabilities, or inconsistent builds across
environments. Pin package versions to ensure reproducible and predictable
container builds.

Recommendation:
RUN instruction with 'apk add <package>' should use package pinning form 'apk add
<package>=<version>'
curl -fsSL https://get.docker.com/builds/Linux/x86_64/docker-${DOCKER_VERSION}.tgz | \
tar --strip-components=1 -xvzf - -C /usr/local/bin

Expand Down
2 changes: 1 addition & 1 deletion docker-gc-cron/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM alpine:3.5
FROM alpine:3.24

# Fork of https://github.com/clockworksoul/docker-gc-cron

Expand All @@ -6,7 +6,7 @@

# We get curl so that we can avoid a separate ADD to fetch the Docker binary, and then we'll remove it.
# Blatantly "borrowed" from Spotify's spotify/docker-gc image. Thanks, guys!
RUN apk --no-cache add bash curl tzdata && \

Check warning on line 9 in docker-gc-cron/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[LOW] APK Package Version Not Pinned 

Details:
Installing packages without version pinning allows automatic updates that may
introduce breaking changes, vulnerabilities, or inconsistent builds across
environments. Pin package versions to ensure reproducible and predictable
container builds.

Recommendation:
RUN instruction with 'apk add <package>' should use package pinning form 'apk add
<package>=<version>'
cd /tmp/ && \
curl -sSL -O https://get.docker.com/builds/Linux/x86_64/docker-${DOCKER_VERSION}.tgz && \
tar zxf docker-${DOCKER_VERSION}.tgz && \
Expand All @@ -25,7 +25,7 @@
chmod 0755 /executed-by-cron.sh && \
chmod 0644 /etc/docker-gc-exclude

CMD /generate-crontab.sh > /var/log/cron.log 2>&1 && \

Check warning on line 28 in docker-gc-cron/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[INFO] CMD and ENTRYPOINT Arguments Not Using JSON Notation 

Details:
CMD and ENTRYPOINT instructions using shell form invoke a shell wrapper that can
mask signals and create unexpected process hierarchies. JSON array syntax (exec
form) executes commands directly without shell interpretation, ensuring
predictable signal handling and process management. Use JSON array notation for
CMD and ENTRYPOINT to avoid shell-related issues.

Recommendation:
{{CMD /generate-crontab.sh > /var/log/cron.log 2>&1 && crontab crontab.tmp &&
/usr/sbin/crond && tail -f /var/log/cron.log}} should be in the JSON Notation
crontab crontab.tmp && \
/usr/sbin/crond && \
tail -f /var/log/cron.log
Expand Down
2 changes: 1 addition & 1 deletion flow/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM alpine:3.6
FROM alpine:3.24

Check warning on line 1 in flow/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[INFO] APK Add Using Local Cache Path 

Details:
Alpine Linux package manager caches downloaded files locally, increasing image
size unnecessarily. Docker images should minimize layers and storage overhead.
Use the '--no-cache' flag with 'apk add' to prevent cache storage and eliminate
the need for manual cleanup.

Recommendation:
'RUN' should not contain 'apk add' command without '--no-cache' switch

ENV FLOW_VERSION=0.57.3

Expand Down
2 changes: 1 addition & 1 deletion gitlab-pipeline-checker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
FROM alpine:3.9
FROM alpine:3.24

Check warning on line 1 in gitlab-pipeline-checker/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[MEDIUM] Dockerfile Missing USER Instruction 

Details:
Container images without a specified user instruction run as root by default,
granting unnecessary elevated privileges that increase the impact of potential
container escape vulnerabilities. Running as root violates the principle of least
privilege and expands the attack surface. Specify a non-root user to minimize
privilege escalation risks.

Recommendation:
The 'Dockerfile' should contain the 'USER' instruction

ENV VERSION=1.0

RUN apk --no-cache add curl ca-certificates jq && \

Check warning on line 5 in gitlab-pipeline-checker/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[LOW] APK Package Version Not Pinned 

Details:
Installing packages without version pinning allows automatic updates that may
introduce breaking changes, vulnerabilities, or inconsistent builds across
environments. Pin package versions to ensure reproducible and predictable
container builds.

Recommendation:
RUN instruction with 'apk add <package>' should use package pinning form 'apk add
<package>=<version>'
update-ca-certificates

COPY wait_for_pipeline.sh /usr/bin/wait_for_pipeline
Expand Down
2 changes: 1 addition & 1 deletion s3-sftp/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM alpine:3.5
FROM alpine:3.24

Check warning on line 1 in s3-sftp/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[LOW] APK Package Version Not Pinned 

Details:
Installing packages without version pinning allows automatic updates that may
introduce breaking changes, vulnerabilities, or inconsistent builds across
environments. Pin package versions to ensure reproducible and predictable
container builds.

Recommendation:
RUN instruction with 'apk add <package>' should use package pinning form 'apk add
<package>=<version>'

Check warning on line 1 in s3-sftp/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[LOW] HEALTHCHECK Instruction Missing 

Details:
Containers without health checks cannot automatically restart upon failure,
reducing service reliability and potentially leaving unresponsive containers
running. Health checks enable orchestration platforms to detect and remediate
failed containers. Configure a HEALTHCHECK instruction to monitor container
health status.

Recommendation:
Dockerfile should contain instruction 'HEALTHCHECK'

ARG S3FS_VERSION=v1.82

Expand All @@ -20,7 +20,7 @@
rm -rf /tmp/*

VOLUME /etc/ssh
EXPOSE 22

Check warning on line 23 in s3-sftp/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[INFO] SSH Port (22) Exposed 

Details:
Exposing SSH port 22 to the internet increases attack surface by allowing direct
access attempts to container services. Publicly exposed administrative ports face
constant automated scanning and brute-force attacks. Restrict SSH access to
trusted networks or remove the exposure entirely.

Recommendation:
'EXPOSE' shouldn't contain the port 22
ENTRYPOINT ["/entrypoint"]
CMD ["/usr/sbin/sshd", "-D", "-f", "/etc/ssh/sshd_config"]
LABEL name=s3-sftp version=dev \
Expand Down
2 changes: 1 addition & 1 deletion tox/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
FROM alpine:3.21
FROM alpine:3.24

ENV PATH="$PATH:/root/.pyenv/bin:/root/.pyenv/shims"
ENV version=4.24.1

RUN apk add --no-cache --virtual=.build-deps bzip2-dev cargo curl git linux-headers ncurses-dev openssl-dev patch readline-dev sqlite-dev sqlite-dev xz-dev zlib-dev && \

Check warning on line 6 in tox/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[INFO] Package Manager Update Not Combined With Install 

Details:
Package manager update commands run separately from install commands create stale
package indexes, potentially installing outdated software versions with known
vulnerabilities. Combining update and install in a single RUN statement ensures
packages are installed from the latest repository metadata.

Recommendation:
Instruction 'RUN apk ["add"]' should be followed by 'RUN apk ["update"]' in the
same 'RUN' statement

Check warning on line 6 in tox/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[LOW] APK Package Version Not Pinned 

Details:
Installing packages without version pinning allows automatic updates that may
introduce breaking changes, vulnerabilities, or inconsistent builds across
environments. Pin package versions to ensure reproducible and predictable
container builds.

Recommendation:
RUN instruction with 'apk add <package>' should use package pinning form 'apk add
<package>=<version>'

Check warning on line 6 in tox/Dockerfile

View check run for this annotation

Orca Security (EU) / Orca Security - Infrastructure as Code

[LOW] Pip Install Keeping Cached Packages 

Details:
Docker images with pip package installations without the '--no-cache-dir' flag
retain unnecessary cache files, unnecessarily increasing image size and attack
surface. Larger images consume more storage, increase transfer times, and may
contain stale cached data. Use '--no-cache-dir' with pip install commands to
minimize image size.

Recommendation:
The '--no-cache-dir' flag should be set when running 'pip/pip3 install'
apk add --no-cache --virtual=.run-deps bash build-base curl-dev openssl readline libffi libbz2 libffi-dev bzip2 ncurses sqlite sqlite-libs zlib xz postgresql-dev ca-certificates && \
curl --location https://raw.githubusercontent.com/pyenv/pyenv-installer/master/bin/pyenv-installer | bash && \
pyenv update && \
Expand Down