julius.joska/sepot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

deploy(relay): upgrade base packages in the runtime image

Browse Source 
The bookworm-slim base ships fixable CVEs (perl-base and friends); apply
Debian's security updates at build time.
This commit is contained in:
Julius Joska
2026-10-09 14:06:42 +02:00
parent 00739ac8a0
commit b824f62878
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/relay/Dockerfile
+4 -1
View File
@@ -27,7 +27,10 @@ ARG GIT_SHA=dev
LABEL org.opencontainers.image.revision=$GIT_SHA \ LABEL org.opencontainers.image.revision=$GIT_SHA \
org.opencontainers.image.source="https://github.com/juliusjoska/sepot" org.opencontainers.image.source="https://github.com/juliusjoska/sepot"
ENV SEPOT_REVISION=$GIT_SHA ENV SEPOT_REVISION=$GIT_SHA
RUN apt-get update && apt-get install -y --no-install-recommends \ # upgrade: základ bookworm-slim nese opravitelné CVE v perl-base a spol.;
# bez něj by každý build vozil zranitelnosti, které Debian už opravil.
RUN apt-get update && apt-get upgrade -y --no-install-recommends \
&& apt-get install -y --no-install-recommends \
ca-certificates curl \ ca-certificates curl \
&& rm -rf /var/lib/apt/lists/* \ && rm -rf /var/lib/apt/lists/* \
&& useradd -r -s /usr/sbin/nologin sepot \ && useradd -r -s /usr/sbin/nologin sepot \