fix: Address CVE in Alpine base image (#496)

Signed-off-by: Leonard Goodell <[email protected]> Co-authored-by: Leonard Goodell <[email protected]>
edgexfoundry · Jun 3, 2024 · b5fd43a · b5fd43a
1 parent 9ba2c33
commit b5fd43a
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/scripts/Dockerfile.alpine b/scripts/Dockerfile.alpine
@@ -19,7 +19,11 @@ FROM ${BASE}
 LABEL maintainer="IOTech <[email protected]>"
 RUN wget https://iotech.jfrog.io/artifactory/api/security/keypair/public/repositories/alpine-release -O /etc/apk/keys/alpine.dev.rsa.pub
 RUN echo 'https://iotech.jfrog.io/artifactory/alpine-release/v3.18/main' >> /etc/apk/repositories
-RUN apk add --update --no-cache binutils gcc libc-dev make git cmake yaml-dev curl-dev libmicrohttpd-dev util-linux-dev ncurses-dev libcbor-dev iotech-paho-mqtt-c-dev-1.3 hiredis-dev iotech-iot-1.5-dev && mkdir -p /edgex-c-sdk/build
+
+RUN apk add --update --no-cache binutils gcc libc-dev make git cmake yaml-dev curl-dev libmicrohttpd-dev util-linux-dev ncurses-dev libcbor-dev iotech-paho-mqtt-c-dev-1.3 hiredis-dev iotech-iot-1.5-dev dumb-init && mkdir -p /edgex-c-sdk/build
+# Ensure using latest versions of all installed packages to avoid any recent CVEs
+RUN apk --no-cache upgrade
+
 COPY VERSION /edgex-c-sdk/
 COPY src /edgex-c-sdk/src/
 COPY include /edgex-c-sdk/include/

diff --git a/scripts/Dockerfile.alpine-base b/scripts/Dockerfile.alpine-base
@@ -36,7 +36,10 @@ LABEL maintainer="IOTech <[email protected]>"
 
 RUN wget https://iotech.jfrog.io/artifactory/api/security/keypair/public/repositories/alpine-release -O /etc/apk/keys/alpine.dev.rsa.pub
 RUN echo 'https://iotech.jfrog.io/artifactory/alpine-release/v3.18/main' >> /etc/apk/repositories
-RUN apk add --update --no-cache binutils gcc libc-dev make git cmake yaml curl libmicrohttpd libuuid libcbor iotech-paho-mqtt-c-dev-1.3 iotech-iot-1.5 hiredis-dev
+
+RUN apk add --update --no-cache binutils gcc libc-dev make git cmake yaml curl libmicrohttpd libuuid libcbor iotech-paho-mqtt-c-dev-1.3 iotech-iot-1.5 hiredis-dev dumb-init
+# Ensure using latest versions of all installed packages to avoid any recent CVEs
+RUN apk --no-cache upgrade
 
 COPY --from=builder /usr/local/include/edgex /usr/local/include/edgex
 COPY --from=builder /usr/local/lib /usr/local/lib