ROX-10097: Use official nginx image for docs#1576
Closed
Conversation
5218564 to
5061a58
Compare
msugakov
requested changes
May 5, 2022
Contributor
msugakov
left a comment
There was a problem hiding this comment.
Sorry. I don't think we should do this. I don't know what problem the image size causes and why it is worth solving.
Contributor
|
The list of installed packages might be different, hence the vulnerable surface. I'd support the change if the difference is dramatic. |
Contributor
Author
@msugakov Do we need emacs, perl and python? Recent vulnerabilities were reported in one of the python libs and that's why we move to ubi minimal (#1054) or micro (#1220) |
|
Tag for build #517332 is 💻 For deploying this image using the dev scripts, run the following first: export MAIN_IMAGE_TAG='3.70.x-5-g338b33e7dc'🕹️ A |
Contributor
|
First things first, here's a link to a Slack thread with the context https://srox.slack.com/archives/C0321S70YK1/p1651168113744619 Secondly, if the problem that we're solving is vulnerabilities in the docs image, we can try address by adding The spell looks like this WDYT @janisz |
Contributor
|
Finally, you may want to link this PR to https://issues.redhat.com/browse/ROX-10097 @janisz |
Contributor
|
Also, I don't know why is there such a concern about |
Contributor
Author
|
We used to have |
Contributor
|
The main point for me to stick with the Red Hat images is consistency. We also use ubi/nginx from Red Hat registry downstream (although that one wasn't updated 1.18->1.20). Having smaller difference between upstream and downstream dockerfiles saves mental overhead when adapting changes and allows detecting issues during normal CI. To the example you are providing, vulnerabilities are temporal. I am 100% sure that if you'd stay with just-ubi longer, |
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Current docs image contains much more packages then we need. This creates big areas for vulnerabilities.
By using smaller official image we reduce number of potentially vulnerable packages.
Config was obtained with
docker run -p 8081:8080 registry.access.redhat.com/ubi8/nginx-120:latest cat /etc/nginx/nginx.confbut it will be better if we could use defaults and expose port80and changed to reflect new static files path.Testing Performed
N/A