-
Notifications
You must be signed in to change notification settings - Fork 150
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Several openssl and glibc vulnerabilities reported by snyk in the docker image #605
Comments
Hi, thanks for the report. The bazel-remote container images aren't built using a Dockerfile, they're built using the |
The snyk report mentions vulnerabilities in openssl and glibc. These libraries seem to come from the gcr.io/distroless/base-debian11 container image that rules_docker uses for go_image's with cgo enabled. So I wonder if the rules_docker upgrade mentioned above upgraded these components- could you try rescanning docker.io/buchgr/bazel-remote-cache:latest ? Note that even though openssl is included in this image, bazel-remote doesn't use it (go has its own TLS implementation). |
Hi @mostynb thanks for replying so quickly. I tried with the latest and I got the same result. Good to know that |
I sent this PR with the most recent rules_go and gazelle. Waiting for PR build result, even though build didn't work on my Mac m1. I wanted to push an updated version of the docker image to have it scanned again by Snyk but of course, if I cannot build there was not much I could do |
I added your changes to the master branch, but as I mentioned in the other PR I don't think it will help this issue. While I haven't figured out how to upgrade the distroless base image yet, I have found a reference that seems to agree with the diagnosis: https://github.com/GoogleContainerTools/distroless/blob/main/base/README.md confirms that gcr.io/distroless/static is used for go apps that use cgo, and libssl + openssl are included. It might be that we can avoid the warnings if we can find a suitable base image with recent glibc but without openssl and libssl, and specify that in the |
Hmm: there's work-in-progress in distroless to create "base-nossl" images: GoogleContainerTools/distroless#1098 |
Wow. That's good news @mostynb. I might be able to convince security by having them take a look at that issue. Thanks a million |
Since we enabled cgo, the docker container images switched to use a distroless base image with glibc and openssl. We want to avoid thinking about openssl security issues/upgrades, especially since bazel-remote doesn't use openssl (go has its own TLS implementation). There is work-in-progress distroless PR to add "base-nossl-debian11" images, which do not include openssl. Let's try it out: GoogleContainerTools/distroless#1098 Relates to buchgr#605.
Since we enabled cgo, the docker container images switched to use a distroless base image with glibc and openssl. We want to avoid thinking about openssl security issues/upgrades, especially since bazel-remote doesn't use openssl (go has its own TLS implementation). There is work-in-progress distroless PR to add "base-nossl-debian11" images, which do not include openssl. Let's try it out: GoogleContainerTools/distroless#1098 Relates to buchgr#605.
@bu3: I figured out how to try the preview distroless base-nossl-debian11 images: #611 Here's a test image, I wonder if you could scan this? https://hub.docker.com/layers/mostynb/bazel-remote-cache/no-openssl-amd64/images/sha256-a66cf03d5ad1b766018bdb90190840e1f174e13aeee89dc9545c97cb88304d74?context=repo |
Since we enabled cgo, the docker container images switched to use a distroless base image with glibc and openssl. We want to avoid thinking about openssl security issues/upgrades, especially since bazel-remote doesn't use openssl (go has its own TLS implementation). There is work-in-progress distroless PR to add "base-nossl-debian11" images, which do not include openssl. Let's try it out: GoogleContainerTools/distroless#1098 Relates to buchgr#605.
You're great @mostynb! This will help me a lot in building my case with the security department. Thanks a million |
Thanks for following up. I landed the change, it's available in buchgr/bazel-remote-cache:latest now, and will be in the next release (maybe in a week or two). |
Since we enabled cgo, the docker container images switched to use a distroless base image with glibc and openssl. We want to avoid thinking about openssl security issues/upgrades, especially since bazel-remote doesn't use openssl (go has its own TLS implementation). There is work-in-progress distroless PR to add "base-nossl-debian11" images, which do not include openssl. Let's try it out: GoogleContainerTools/distroless#1098 Relates to buchgr#605.
Hi,
I was trying to use the docker image from Dockerhub but the Snyk scanner that runs in my organization raised several vulnerabilities related to
debian:11
.It sounds like the base image is quite outdated.
I've uploaded the scanner report here:
snyk.report.zip
I couldn't find the Dockerfile in the repo, otherwise, I'd have tried to upgrade it by self and then send a PR.
The text was updated successfully, but these errors were encountered: