Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ci: switch to wolfi as distroless base #1339

Closed
wants to merge 1 commit into from
Closed

ci: switch to wolfi as distroless base #1339

wants to merge 1 commit into from

Conversation

xopham
Copy link
Collaborator

@xopham xopham commented Oct 27, 2023 •
edited
Loading

Fixes no issue

Description

  • switch to wolfi as base distroless base image

Checklist

  • PR is rebased to/aimed at branch develop
  • PR follows Contributing Guide
  • Added tests (if necessary)
  • Extended README/Documentation (if necessary)
  • Adjusted versions of image and Helm chart in Chart.yaml (if necessary)

github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 27, 2023
View reviewed changes
docker/Dockerfile
@@ -1,8 +1,11 @@
FROM python:3.11-alpine as base
FROM cgr.dev/chainguard/wolfi-base as base

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 5: containerImage not pinned by hash
Click Remediation section below to solve this issue
docker/Dockerfile
&& YARL_NO_EXTENSIONS=1 MULTIDICT_NO_EXTENSIONS=1 pip install --no-cache-dir --prefix=/install -r /requirements.txt
RUN apk add --no-cache gcc
USER nonroot
RUN YARL_NO_EXTENSIONS=1 MULTIDICT_NO_EXTENSIONS=1 pip install -r /requirements.txt --no-cache-dir --user

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 5: pipCommand not pinned by hash
Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 27, 2023
View reviewed changes
docker/Dockerfile
@@ -1,8 +1,11 @@
FROM python:3.11-alpine as base
FROM cgr.dev/chainguard/wolfi-base as base

Check warning

Code scanning / Hadolint

Always tag the version of an image explicitly Warning

Always tag the version of an image explicitly
docker/Dockerfile

# Build dependencies
FROM base as builder

ARG version=3.11
RUN apk add python-${version} py${version}-pip

Check warning

Code scanning / Hadolint

Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> Warning

Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>
docker/Dockerfile

# Build dependencies
FROM base as builder

ARG version=3.11
RUN apk add python-${version} py${version}-pip

Check notice

Code scanning / Hadolint

Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/* when done installing packages Note

Use the --no-cache switch to avoid the need to use --update and remove /var/cache/apk/\* when done installing packages
docker/Dockerfile
RUN apk add --no-cache musl-dev gcc \
&& pip install --no-cache-dir --upgrade pip~=22.3 \
&& YARL_NO_EXTENSIONS=1 MULTIDICT_NO_EXTENSIONS=1 pip install --no-cache-dir --prefix=/install -r /requirements.txt
RUN apk add --no-cache gcc

Check warning

Code scanning / Hadolint

Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> Warning

Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>
docker/Dockerfile
# Harden image
COPY docker/harden.sh /
RUN sh /harden.sh && rm /harden.sh
RUN apk add --no-cache python-${version} && chown -R nonroot.nonroot /app/

Check warning

Code scanning / Hadolint

Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version> Warning

Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 27, 2023
View reviewed changes
docker/Dockerfile
@@ -1,8 +1,11 @@
FROM python:3.11-alpine as base
FROM cgr.dev/chainguard/wolfi-base as base

Check failure

Code scanning / checkov

Ensure the base image uses a non latest version tag Error

Ensure the base image uses a non latest version tag
docker/Dockerfile Outdated
Comment on lines 36 to 56
# Build Connaisseur image
FROM base

ARG version=3.11
WORKDIR /app

# Harden image
COPY docker/harden.sh /
RUN sh /harden.sh && rm /harden.sh
RUN apk add --no-cache python-${version} && chown -R nonroot.nonroot /app/

USER nonroot

# Copy source code and install packages
COPY --from=builder /install /usr/local
COPY --from=builder /home/nonroot/.local/lib/python3.11/site-packages /home/nonroot/.local/lib/python3.11/site-packages
COPY --from=builder /home/nonroot/.local/bin /usr/local/bin
COPY --from=cosign_loader /go/cosign/cosign-linux-amd64 /app/cosign/cosign
COPY connaisseur /app/connaisseur

USER 10001:20001

LABEL org.opencontainers.image.documentation="https://sse-secure-systems.github.io/connaisseur/"
LABEL org.opencontainers.image.authors="Philipp Belitz <philipp.belitz@securesystems.de>, Anneke Breust <anneke.breust@securesystems.de>, Christoph Hamsen <christoph.hamsen@securesystems.de>, Teetje Stark <teetje.stark@securesystems.de>"
LABEL org.opencontainers.image.vendor="Secure Systems Engineering"

CMD ["python", "-m", "connaisseur"]
ENTRYPOINT ["python", "-m", "connaisseur"]

Check failure

Code scanning / checkov

Ensure that HEALTHCHECK instructions have been added to container images Error

Ensure that HEALTHCHECK instructions have been added to container images
@xopham xopham force-pushed the ci/switch2wolfi-base branch from 24c4b78 to a99ed8d Compare October 27, 2023 14:51
@xopham xopham force-pushed the ci/switch2wolfi-base branch from a99ed8d to ef4e3eb Compare December 8, 2023 10:55
@codecov-commenter
Copy link

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (2a57655) 96.64% compared to head (ef4e3eb) 96.64%.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files 
@@           Coverage Diff            @@
##           develop    #1339   +/-   ##
========================================
  Coverage    96.64%   96.64%           
========================================
  Files           23       23           
  Lines         1343     1343           
========================================
  Hits          1298     1298           
  Misses          45       45

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@phbelitz
Copy link
Member

no longer needed as we use scratch images now

@phbelitz phbelitz closed this May 24, 2024
@Starkteetje Starkteetje deleted the ci/switch2wolfi-base branch October 25, 2024 09:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@xopham @codecov-commenter @phbelitz