Updating base images to fix vulnerabilities #643
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The current base images used to build kamus images are old and contains many vulnerabilities.
This PR:
I tried to run the dotnet apps using the latest alpine image, but got stuck on the multiple issue of the grpc core library in alpine (as per grpc/grpc#21446). I tried multiple options as recommended in the issue, but in the end I was only able to reproduce the segfault issue #455. The only work-around that I could get working was by downgrading lib6-compat to 1.19 (as per grpc/grpc#21446 (comment)) but it introduces different critical and high vulnerabilities because of older version of apk and musl.
When the Google KMS package migrate to the latest Grpc.Net.Client package (planned 2022 Q1 or Q2), we should be able to ditch ubuntu and run kamus on alpine, reducing the attack surface even further.