From 781397f128d29a46307d9468f5f83c12426a9b39 Mon Sep 17 00:00:00 2001 From: Christian Haudum Date: Wed, 27 Nov 2024 11:31:42 +0100 Subject: [PATCH] chore!: Remove `wget` from Promtail docker image (#15101) The package has been added to the Docker image with PR #11711 with the intention to support the Docker healthcheck. However, to reduce the attack surface of our Docker images, we want to keep them as slim as possible. The current version of Promtail (3.3.0) for example contains a wget version with vulnerability [CVE-2024-38428](https://security-tracker.debian.org/tracker/CVE-2024-38428). The healthcheck can be achieved by other means, e.g. 1. Extend the `grafana/promtail` base image and add `wget` using `apt install wget` https://github.com/grafana/loki/issues/11590#issuecomment-2106037181 3. Use low-level `/dev/tcp/127.0.0.1:9080` to establish a connection and check the exit code https://github.com/grafana/loki/issues/11590#issuecomment-2333481326 Original discussion about adding wget https://github.com/grafana/loki/issues/11590 This may break someone's Docker compose installation, when they require on the `wget` powered health check. Signed-off-by: Christian Haudum (cherry picked from commit 2eea54692e25ef540b0f04b7d99cf5634fa755b2) --- clients/cmd/promtail/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clients/cmd/promtail/Dockerfile b/clients/cmd/promtail/Dockerfile index 3c9088bb83ba9..2942f41614f2f 100644 --- a/clients/cmd/promtail/Dockerfile +++ b/clients/cmd/promtail/Dockerfile @@ -10,7 +10,7 @@ RUN make clean && make BUILD_IN_CONTAINER=false PROMTAIL_JOURNAL_ENABLED=true pr FROM debian:12.5-slim # tzdata required for the timestamp stage to work RUN apt-get update && \ - apt-get install -qy tzdata ca-certificates wget libsystemd-dev && \ + apt-get install -qy tzdata ca-certificates libsystemd-dev && \ rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml