From ce659b90c6b04c478a064952354ae147816c4331 Mon Sep 17 00:00:00 2001 From: Rodrigo Garcia Date: Fri, 7 Jun 2024 09:26:23 -0700 Subject: [PATCH 1/3] fix alpine image tag in Dockerfile (should be same as upstream) to address security vulnerabilities --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 1a6ce9355..7d02b6653 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,7 +15,7 @@ WORKDIR /go-ethereum RUN go run build/ci.go install -static ./cmd/geth # Pull Geth into a second stage deploy alpine container -FROM alpine:3.15.7 +FROM alpine:latest RUN apk add --no-cache ca-certificates From 9cf018662bebb89d20826b2c03e1eed88be5b028 Mon Sep 17 00:00:00 2001 From: Rodrigo Garcia Date: Fri, 7 Jun 2024 10:14:01 -0700 Subject: [PATCH 2/3] using current stable tag to satisfy linter --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 7d02b6653..f9771f0ab 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,7 +15,7 @@ WORKDIR /go-ethereum RUN go run build/ci.go install -static ./cmd/geth # Pull Geth into a second stage deploy alpine container -FROM alpine:latest +FROM alpine:3.20 RUN apk add --no-cache ca-certificates From 19c37b99aa74e90ac81de06ab8ce813fd2d8d3bc Mon Sep 17 00:00:00 2001 From: Rodrigo Garcia Date: Fri, 7 Jun 2024 10:48:35 -0700 Subject: [PATCH 3/3] using alpine:3.19 instead because there is an new CVE for openssl on 3.20 without a fix --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index f9771f0ab..1e9be1bf0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,7 +15,7 @@ WORKDIR /go-ethereum RUN go run build/ci.go install -static ./cmd/geth # Pull Geth into a second stage deploy alpine container -FROM alpine:3.20 +FROM alpine:3.19 RUN apk add --no-cache ca-certificates