Conversation
(cherry picked from commit 8781d51)
|
Tag for build #299020 is 💻 For deploying this image using the dev scripts, run the following first: export MAIN_IMAGE_TAG='3.69.x-65-g0f7fcc7872'📦 You can also generate an installation bundle with: docker run -i --rm stackrox/main:3.69.x-65-g0f7fcc7872 central generate interactive > bundle.zip🕹️ A |
|
There is a conceptually conflicting PR #839, which tries to avoid the reported vulnerabilities by switching to ubi8-micro base image. |
misberner
left a comment
There was a problem hiding this comment.
This seems fine. I don't think we can migrate all containers to ubi-micro so it's not conceptually conflicting. It's also highly unlikely that these will become real vulns as they have been fixed for a while.
Should there ever be vulnerabilities we are not super confident about, I think the right move would be to add an expires field here, such that a suppression is only respected if the current time is earlier than expires. This would mimic the "CVE snoozing" feature in the product.
(cherry picked from commit 8781d51)
Checklist
Unit test and regression tests addedEvaluated and added CHANGELOG entry if requiredDetermined and documented upgrade stepsDocumented user facing changes (create PR based on stackrox/openshift-docs and merge into rhacs-docs)Testing Performed
None