Fix remaining moderate & low security issues [BW-774] (#730)

DataBiosphere · Aug 3, 2021 · 6656751 · 6656751
1 parent b713321
commit 6656751
Show file tree

Hide file tree

Showing 8 changed files with 10 additions and 85 deletions.
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
@@ -11,7 +11,6 @@ jobs:
       matrix:
         workdir:
         - servers/cromwell
-        - servers/dsub
         - ui
 
     steps:

diff --git a/README.md b/README.md
@@ -1,12 +1,11 @@
 # Job Manager
 
 [![CircleCI branch](https://img.shields.io/circleci/project/github/DataBiosphere/job-manager/master.svg?label=Tests%20on%20Circle%20CI&style=flat-square)](https://circleci.com/gh/DataBiosphere/job-manager/tree/master)
-![Github](https://img.shields.io/badge/Supported%20Backends-cromwell%20%7C%20dsub-blue.svg?&style=flat-square)
+![Github](https://img.shields.io/badge/Supported%20Backends-cromwell-blue.svg?&style=flat-square)
 ![GitHub](https://img.shields.io/github/license/DataBiosphere/job-manager.svg?color=orange&style=flat-square)
 [![GitHub release](https://img.shields.io/github/release/DataBiosphere/job-manager.svg?label=Latest%20Release&style=flat-square&colorB=green)](https://github.com/DataBiosphere/job-manager/releases)
-[![Github](https://img.shields.io/badge/Docker%20Image-UI-blue.svg?style=flat-square)](https://cloud.docker.com/u/databiosphere/repository/docker/databiosphere/job-manager-ui)
-[![Github](https://img.shields.io/badge/Docker%20Image-dsub%20shim%20API-blue.svg?style=flat-square)](https://cloud.docker.com/u/databiosphere/repository/docker/databiosphere/job-manager-api-dsub)
-[![Github](https://img.shields.io/badge/Docker%20Image-cromwell%20shim%20API-blue.svg?style=flat-square)](https://cloud.docker.com/u/databiosphere/repository/docker/databiosphere/job-manager-api-cromwell)
+[![Github](https://img.shields.io/badge/Docker%20Image-UI-blue.svg?style=flat-square)](https://console.cloud.google.com/gcr/images/broad-dsp-gcr-public/US/job-manager-ui)
+[![Github](https://img.shields.io/badge/Docker%20Image-cromwell%20shim%20API-blue.svg?style=flat-square)](https://console.cloud.google.com/gcr/images/broad-dsp-gcr-public/US/job-manager-api-cromwell)
 
 ## Lifecycle notice
 

diff --git a/servers/cromwell/Dockerfile b/servers/cromwell/Dockerfile
@@ -6,6 +6,7 @@ ADD ./ /job-manager
 
 RUN /bin/bash -c scripts/rebuild_swagger.sh
 
+# We cannot yet adopt a blessed Python image because Job Manager uses python2 and blessed only has 3
 FROM gcr.io/google-appengine/python
 
 WORKDIR /app

diff --git a/servers/dsub/Dockerfile b/servers/dsub/Dockerfile
diff --git a/servers/dsub/Dockerfile.dev b/servers/dsub/Dockerfile.dev
diff --git a/servers/dsub/Dockerfile.local b/servers/dsub/Dockerfile.local
diff --git a/ui/Dockerfile b/ui/Dockerfile
@@ -21,7 +21,7 @@ RUN npm install
 
 RUN /ui/node_modules/.bin/ng build --prod
 
-FROM nginx:mainline-alpine
+FROM us.gcr.io/broad-dsp-gcr-public/base/nginx:mainline-alpine
 
 COPY --from=1 /ui/dist /ui/dist
 ADD ./ui/nginx.prod.conf /etc/nginx/nginx.conf
diff --git a/ui/nginx.prod.conf b/ui/nginx.prod.conf
@@ -4,6 +4,11 @@
 # Note: this nginx configuration is a default template, to deploy Job Manager on various types of servers,
 # such as Google App Engine, Google Kubernetes Engine, etc. please override this file
 
+# For compatibility with Nginx "unprivileged" blessed base image [0], put the PID somewhere not-privileged [1]
+# [0] https://github.com/broadinstitute/dsp-appsec-blessed-images/blob/main/nginx/Dockerfile.stable-alpine#L1
+# [1] https://broadinstitute.slack.com/archives/CADU7L0SZ/p1627588528360200?thread_ts=1627578911.354100&cid=CADU7L0SZ
+pid /tmp/nginx.pid;
+
 # Required - just leave the defaults for now.
 events {}