From 9859f5fafc978b8b91e51962b0147e71a4546ab7 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Tue, 14 Apr 2026 02:08:15 -0700 Subject: [PATCH] build(docker): upgrade all Alpine packages in final image (#9070) build(docker): apply full apk upgrade in final image to pick up security patches Trivy flagged CVE-2026-28390 (libcrypto3/libssl3) on the published image because the final stage only upgraded zlib. Broaden to `apk upgrade --no-cache` so all Alpine security fixes land at build time. --- docker/Dockerfile.go_build | 2 +- docker/Dockerfile.local | 2 +- docker/Dockerfile.rocksdb_large | 2 +- docker/Dockerfile.rocksdb_large_local | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docker/Dockerfile.go_build b/docker/Dockerfile.go_build index 34c0ab56a..a80a3cdef 100644 --- a/docker/Dockerfile.go_build +++ b/docker/Dockerfile.go_build @@ -56,7 +56,7 @@ COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh # To disable: docker run -e GODEBUG=fips140=off ... # Install dependencies and create non-root user -RUN apk upgrade --no-cache zlib && \ +RUN apk upgrade --no-cache && \ apk add --no-cache fuse curl su-exec libgcc libcrypto3 libssl3 && \ addgroup -g 1000 seaweed && \ adduser -D -u 1000 -G seaweed seaweed diff --git a/docker/Dockerfile.local b/docker/Dockerfile.local index bd4102e78..c37e5f78a 100644 --- a/docker/Dockerfile.local +++ b/docker/Dockerfile.local @@ -7,7 +7,7 @@ COPY ./filer.toml /etc/seaweedfs/filer.toml COPY ./entrypoint.sh /entrypoint.sh # Install dependencies and create non-root user -RUN apk upgrade --no-cache zlib && \ +RUN apk upgrade --no-cache && \ apk add --no-cache fuse curl su-exec && \ addgroup -g 1000 seaweed && \ adduser -D -u 1000 -G seaweed seaweed diff --git a/docker/Dockerfile.rocksdb_large b/docker/Dockerfile.rocksdb_large index 4942a2dcb..6013aacf9 100644 --- a/docker/Dockerfile.rocksdb_large +++ b/docker/Dockerfile.rocksdb_large @@ -34,7 +34,7 @@ COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer_rocksdb. COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh # Install dependencies and create non-root user -RUN apk upgrade --no-cache zlib && \ +RUN apk upgrade --no-cache && \ apk add --no-cache fuse snappy gflags curl su-exec && \ addgroup -g 1000 seaweed && \ adduser -D -u 1000 -G seaweed seaweed diff --git a/docker/Dockerfile.rocksdb_large_local b/docker/Dockerfile.rocksdb_large_local index 3b090734a..007a6a8a0 100644 --- a/docker/Dockerfile.rocksdb_large_local +++ b/docker/Dockerfile.rocksdb_large_local @@ -17,7 +17,7 @@ COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer_rocksdb. COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh # Install dependencies and create non-root user -RUN apk upgrade --no-cache zlib && \ +RUN apk upgrade --no-cache && \ apk add --no-cache fuse snappy gflags curl tmux su-exec && \ addgroup -g 1000 seaweed && \ adduser -D -u 1000 -G seaweed seaweed