diff --git a/.github/containerscan/allowedlist.yaml b/.github/containerscan/allowedlist.yaml index 680d17a..67e30e8 100644 --- a/.github/containerscan/allowedlist.yaml +++ b/.github/containerscan/allowedlist.yaml @@ -1,30 +1,3 @@ general: - vulnerabilities: - - CVE-2021-30465 - - CVE-2022-1015 - - CVE-2022-1116 - - CVE-2022-21499 - - CVE-2022-29217 - - CVE-2022-30034 - - CVE-2021-33026 - - CVE-2015-3627 - - CVE-2021-3121 - - CVE-2019-16884 - - CVE-2019-19921 - - CVE-2022-29361 - - CVE-2022-27664 - - CVE-2022-3515 - - CVE-2022-40023 - - CVE-2022-38054 - - CVE-2017-11468 - - CVE-2022-29162 - - CVE-2019-9512 - - CVE-2019-9514 - - CVE-2021-33194 - - CVE-2021-44716 - - CVE-2022-27664 - - CVE-2022-23960 - - CVE-2022-41672 - bestPracticeViolations: - CIS-DI-0010 diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 1f1f786..a965899 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -30,6 +30,7 @@ jobs: steps: - uses: actions/checkout@v2 + - name: Build image run: docker build ./airflow --file ./airflow/Dockerfile --no-cache --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}" diff --git a/airflow/Dockerfile b/airflow/Dockerfile index 4ff7809..fc85bab 100644 --- a/airflow/Dockerfile +++ b/airflow/Dockerfile @@ -1,4 +1,5 @@ -FROM python:3.10-bullseye +FROM bitnami/python:3.10.11-debian-11-r13 + MAINTAINER michael.graf@uni-tuebingen.de ENV DEBIAN_FRONTEND=noninteractive @@ -32,6 +33,14 @@ COPY ./dags /root/airflow/dags COPY entrypoint.sh /root/entrypoint.sh RUN chmod +x /root/entrypoint.sh + +# uninstall curl/libcurl3-gnutls from the image +RUN apt-get remove -y libcurl3-gnutls && \ + apt-get remove -y libcurl4 && \ + apt-get autoremove -y && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists + ENTRYPOINT ["/root/entrypoint.sh"] CMD ["webserver"]