fix(docker): pin runtime base to alpine:3.24 - #740
Merged
Conversation
The runtime stage used a floating `alpine`, and the release workflow only rebuilds the version and `latest` tags on a `v*` tag push. The published 2.1.1 / latest image therefore still ships Alpine 3.23.3, whose musl, zlib and openssl packages have fixes available in later revisions. Pinning to the 3.24 branch rather than an exact 3.24.1: this repo has no dependabot or renovate config, so an exact pin would go stale with no mechanism to bump it. The branch pin still picks up patch-level security fixes on every build while removing the risk of a major Alpine bump landing unnoticed in a release build. Note that this does not refresh anything already published; the tags are only rebuilt when a new release is cut. Refs #738 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses #738, reported by @unitmatrix. All the facts in that report check out — verified independently:
latestand2.1.1are the same image, pushed 2026-03-27sha256:86dd0b7c…latestruns Alpine 3.23.3/etc/alpine-release→3.23.3unstablealready on 3.24.1alpine:latestmaps to 3.24.1latestonly rebuilt on av*tagrelease.yamlison: push: tags:Change
Why the 3.24 branch and not an exact 3.24.1
The issue proposes
alpine:3.24.1. This repo has no dependabot or renovate config, so an exact pin has nothing to bump it — a release cut next year would still build 3.24.1, trading today's staleness for a slower version of the same bug. The branch pin keeps patch-level security fixes flowing into every build while still removing the real risk of the floating tag, which is a major Alpine bump landing unnoticed in a release build.alpine:3.24resolves to 3.24.1 today, carrying exactly the fixed packages the issue asks for:musl 1.2.6-r2,zlib 1.3.2-r0,libcrypto3/libssl3 3.5.7-r0.This PR does not fix the published image
latestand the version tags are rebuilt only when av*tag is pushed. Merging this changes nothing on Docker Hub until a patch release is cut — that remains the operative fix for the reported exposure.Verification
Full
docker buildgreen. The resulting image reports Alpine 3.24.1 with the package versions above, and/bin/helm-dashboard --versionruns.alpine:3.24publisheslinux/amd64andlinux/arm64manifests, matchingplatforms: linux/amd64,linux/arm64inrelease.yaml, so no architecture is dropped.Out of scope, noted for later: the build stages use
node:latestand a baregolang, also floating. They don't ship (staticCGO_ENABLED=0binary, multi-stage), so no CVE exposure — build reproducibility only.🤖 Generated with Claude Code