graham/aprs.me
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docker updates

Browse source
This commit is contained in:
Graham McIntire 2025-06-15 17:39:28 -05:00
parent c5617b6e8d
commit 7a8a5443f6
No known key found for this signature in database
3 changed files with 79 additions and 128 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

99
.github/workflows/docker-security-scan.yml vendored
View file

@ -62,100 +62,77 @@ jobs:
sarif_file: "trivy-results.sarif" sarif_file: "trivy-results.sarif"
category: "Trivy Scan" category: "Trivy Scan"
- name: Check for outdated base images - name: Run Trivy for outdated OS packages
uses: aquasecurity/trivy-action@master uses: aquasecurity/trivy-action@master
with: with:
image-ref: aprs:${{ github.sha }} image-ref: aprs:${{ github.sha }}
format: "table" format: "table"
output: "outdated-dependencies.txt" output: "os-packages.txt"
exit-code: "0" # Don't fail the build yet severity: "HIGH,CRITICAL"
severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
scanners: "vuln"
vuln-type: "os" vuln-type: "os"
- name: Check for outdated application dependencies - name: Run Trivy for outdated application dependencies
uses: aquasecurity/trivy-action@master uses: aquasecurity/trivy-action@master
with: with:
image-ref: aprs:${{ github.sha }} image-ref: aprs:${{ github.sha }}
format: "table" format: "table"
output: "outdated-app-dependencies.txt" output: "app-packages.txt"
exit-code: "0" # Don't fail the build yet severity: "HIGH,CRITICAL"
severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
scanners: "vuln"
vuln-type: "library" vuln-type: "library"
- name: Upload outdated dependencies report - name: Upload detailed vulnerability reports
uses: actions/upload-artifact@v3 uses: actions/upload-artifact@v3
if: always() if: always()
with: with:
name: dependency-reports name: vulnerability-reports
path: | path: |
outdated-dependencies.txt os-packages.txt
outdated-app-dependencies.txt app-packages.txt
retention-days: 7 retention-days: 7
- name: Check for update availability in base image - name: Run Docker Scout vulnerability scan
run: | uses: docker/scout-action@v1
# Extract base image from Dockerfile
BASE_IMAGE=$(grep 'RUNNER_IMAGE=' Dockerfile | cut -d'"' -f2)
echo "Base image: $BASE_IMAGE"
# Pull latest version of the base image
docker pull $BASE_IMAGE
# Compare the digests
CURRENT_DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' $BASE_IMAGE)
echo "Current digest: $CURRENT_DIGEST"
# Log the findings
echo "Base image update check completed"
echo "It's recommended to periodically update the base image in your Dockerfile"
- name: Scan for security misconfigurations
uses: aquasecurity/trivy-action@master
with: with:
image-ref: aprs:${{ github.sha }} command: quickview,cves
format: "table" image: aprs:${{ github.sha }}
output: "misconfig-results.txt" output-format: sarif
exit-code: "0" only-severities: critical,high
scanners: "config" sarif-file: scout-results.sarif
- name: Upload misconfiguration report - name: Upload Docker Scout results
uses: actions/upload-artifact@v3 uses: actions/upload-artifact@v3
if: always() if: always()
with: with:
name: misconfig-report name: docker-scout-report
path: misconfig-results.txt path: scout-results.sarif
retention-days: 7 retention-days: 7
- name: Generate comprehensive security report - name: Generate security report summary
if: always() if: always()
run: | run: |
echo "# Docker Image Security Report" > security-report.md echo "# Docker Image Security Report" > security-summary.md
echo "## Image: aprs:${{ github.sha }}" >> security-report.md echo "## Image: aprs:${{ github.sha }}" >> security-summary.md
echo "## Date: $(date)" >> security-report.md echo "## Date: $(date)" >> security-summary.md
echo "## Base Image Update Status" >> security-report.md
echo "\`\`\`" >> security-report.md
cat outdated-dependencies.txt >> security-report.md
echo "\`\`\`" >> security-report.md
echo "## Application Dependencies Status" >> security-report.md
echo "\`\`\`" >> security-report.md
cat outdated-app-dependencies.txt >> security-report.md
echo "\`\`\`" >> security-report.md
echo "## Configuration Issues" >> security-report.md
echo "\`\`\`" >> security-report.md
cat misconfig-results.txt >> security-report.md
echo "\`\`\`" >> security-report.md
- name: Upload comprehensive security report echo "### OS Package Vulnerabilities" >> security-summary.md
echo '```' >> security-summary.md
cat os-packages.txt >> security-summary.md || echo "No OS package vulnerabilities report available" >> security-summary.md
echo '```' >> security-summary.md
echo "### Application Dependencies Vulnerabilities" >> security-summary.md
echo '```' >> security-summary.md
cat app-packages.txt >> security-summary.md || echo "No application vulnerabilities report available" >> security-summary.md
echo '```' >> security-summary.md
- name: Upload security summary
uses: actions/upload-artifact@v3 uses: actions/upload-artifact@v3
if: always() if: always()
with: with:
name: security-report name: security-summary
path: security-report.md path: security-summary.md
retention-days: 14 retention-days: 14
- name: Fail on CRITICAL vulnerabilities - name: Check for critical vulnerabilities
run: | run: |
if grep -q "CRITICAL" trivy-results.sarif; then if grep -q "CRITICAL" trivy-results.sarif; then
echo "Critical vulnerabilities found in the Docker image." echo "Critical vulnerabilities found in the Docker image."

25
Dockerfile
View file

@ -11,13 +11,12 @@ ARG RUNNER_IMAGE="debian:${DEBIAN_VERSION}"
FROM ${BUILDER_IMAGE} AS builder FROM ${BUILDER_IMAGE} AS builder
# install build dependencies with full security updates # install build dependencies
RUN apt-get update -y && \ RUN apt-get update -y && \
apt-get upgrade -y --security && \ apt-get upgrade -y && \
apt-get dist-upgrade -y && \
apt-get install -y build-essential git && \ apt-get install -y build-essential git && \
apt-get clean && \ apt-get clean && \
rm -rf /var/lib/apt/lists/* rm -f /var/lib/apt/lists/*_*
# prepare build dir # prepare build dir
WORKDIR /app WORKDIR /app
@ -65,28 +64,16 @@ FROM ${RUNNER_IMAGE}
# Install security updates and required packages # Install security updates and required packages
ENV DEBIAN_FRONTEND=noninteractive ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update -y && \ RUN apt-get update -y && \
# Upgrade all packages with focus on security updates apt-get upgrade -y && \
apt-get upgrade -y --security && \
apt-get dist-upgrade -y && \
# Install unattended-upgrades for automatic security updates
apt-get install -y --no-install-recommends \ apt-get install -y --no-install-recommends \
libstdc++6 \ libstdc++6 \
openssl \ openssl \
libncurses5 \ libncurses5 \
locales \ locales \
ca-certificates \ ca-certificates \
tini \ tini && \
unattended-upgrades \
apt-listchanges && \
# Configure unattended-upgrades to only install security updates
echo 'APT::Periodic::Update-Package-Lists "1";' > /etc/apt/apt.conf.d/20auto-upgrades && \
echo 'APT::Periodic::Unattended-Upgrade "1";' >> /etc/apt/apt.conf.d/20auto-upgrades && \
echo 'Unattended-Upgrade::Origins-Pattern { "origin=Debian,codename=${distro_codename},label=Debian-Security"; };' > /etc/apt/apt.conf.d/50unattended-upgrades && \
echo 'Unattended-Upgrade::Remove-Unused-Dependencies "true";' >> /etc/apt/apt.conf.d/50unattended-upgrades && \
# Remove unnecessary packages
apt-get autoremove -y && \
apt-get clean && \ apt-get clean && \
rm -rf /var/lib/apt/lists/* && \ rm -f /var/lib/apt/lists/*_* && \
# Create a non-root user and group with specific ID # Create a non-root user and group with specific ID
groupadd -g ${GROUP_ID} aprs && \ groupadd -g ${GROUP_ID} aprs && \
useradd -r -g aprs -u ${USER_ID} -s /bin/false -M aprs && \ useradd -r -g aprs -u ${USER_ID} -s /bin/false -M aprs && \

83
scripts/update-docker-image.sh
View file

@ -1,8 +1,5 @@
#!/bin/bash #!/bin/bash
# update-docker-image.sh - Script to update Docker image with latest dependencies # update-docker-image.sh - Script to update Docker image with latest dependencies
#
# This script helps ensure that your Docker image has the latest system dependencies
# by rebuilding the image with the latest base image and system packages.
set -e # Exit immediately if a command exits with a non-zero status set -e # Exit immediately if a command exits with a non-zero status
@ -21,66 +18,56 @@ if ! command -v docker &> /dev/null; then
exit 1 exit 1
fi fi
# Get the latest version of the base image from Dockerfile # Check Docker daemon is running
BASE_IMAGE=$(grep 'DEBIAN_VERSION=' Dockerfile | head -1 | cut -d'=' -f2 | tr -d '"') if ! docker info &> /dev/null; then
if [ -z "$BASE_IMAGE" ]; then echo -e "${RED}Error: Docker daemon is not running${NC}"
echo -e "${RED}Error: Could not determine base image from Dockerfile${NC}"
exit 1 exit 1
fi fi
echo -e "${GREEN}Current base image:${NC} $BASE_IMAGE" # Get the current versions from Dockerfile
ELIXIR_VERSION=$(grep 'ELIXIR_VERSION=' Dockerfile | head -1 | cut -d'=' -f2 | tr -d '"')
OTP_VERSION=$(grep 'OTP_VERSION=' Dockerfile | head -1 | cut -d'=' -f2 | tr -d '"')
DEBIAN_VERSION=$(grep 'DEBIAN_VERSION=' Dockerfile | head -1 | cut -d'=' -f2 | tr -d '"')
# Check if we need to update the Dockerfile echo -e "${GREEN}Current versions:${NC}"
echo -e "${YELLOW}Checking for newer Debian versions...${NC}" echo " Elixir: $ELIXIR_VERSION"
latest_debian=$(curl -s https://hub.docker.com/v2/repositories/library/debian/tags/ | \ echo " OTP: $OTP_VERSION"
grep -o '"name":"[^"]*-slim"' | grep bullseye | sort -r | head -1 | cut -d'"' -f4) echo " Debian: $DEBIAN_VERSION"
if [ -z "$latest_debian" ]; then
echo -e "${YELLOW}Could not determine latest Debian version, keeping current version${NC}"
else
echo -e "${GREEN}Latest Debian version:${NC} $latest_debian"
# Update Dockerfile with latest Debian version
current_version=$(grep 'DEBIAN_VERSION=' Dockerfile | head -1 | cut -d'=' -f2 | tr -d '"')
if [ "$current_version" != "$latest_debian" ]; then
echo -e "${YELLOW}Updating Dockerfile with latest Debian version...${NC}"
sed -i "s/ARG DEBIAN_VERSION=.*/ARG DEBIAN_VERSION=$latest_debian/" Dockerfile
echo -e "${GREEN}Updated Dockerfile with new base image:${NC} $latest_debian"
else
echo -e "${GREEN}Already using the latest Debian version${NC}"
fi
fi
# Check for latest Elixir and OTP versions
echo -e "${YELLOW}Checking for newer Elixir and OTP versions...${NC}"
current_elixir=$(grep 'ELIXIR_VERSION=' Dockerfile | head -1 | cut -d'=' -f2 | tr -d '"')
current_otp=$(grep 'OTP_VERSION=' Dockerfile | head -1 | cut -d'=' -f2 | tr -d '"')
echo -e "${GREEN}Current Elixir version:${NC} $current_elixir"
echo -e "${GREEN}Current OTP version:${NC} $current_otp"
# Build the Docker image with a clean cache to ensure latest deps
echo -e "${YELLOW}Building Docker image with latest dependencies...${NC}" echo -e "${YELLOW}Building Docker image with latest dependencies...${NC}"
echo "This may take a few minutes..."
# Use --pull to ensure we get the latest base image
# Use --no-cache to ensure all layers are rebuilt with latest packages
docker build --no-cache --pull -t aprs:latest . docker build --no-cache --pull -t aprs:latest .
echo -e "${GREEN}Running security scan on updated image...${NC}" # Run a security scan if Trivy is available
if command -v trivy &> /dev/null; then if command -v trivy &> /dev/null; then
echo -e "${GREEN}Running security scan on updated image...${NC}"
trivy image --severity HIGH,CRITICAL aprs:latest trivy image --severity HIGH,CRITICAL aprs:latest
else else
echo -e "${YELLOW}Trivy not installed. Skipping security scan.${NC}" echo -e "${YELLOW}Trivy not installed. Security scan skipped.${NC}"
echo "Install Trivy with: brew install aquasecurity/trivy/trivy (macOS) or similar for your OS" echo "To install Trivy:"
echo " - macOS: brew install aquasecurity/trivy/trivy"
echo " - Linux: see https://aquasecurity.github.io/trivy/latest/getting-started/installation/"
fi fi
echo echo
echo -e "${GREEN}=== Update Complete ===${NC}" echo -e "${GREEN}=== Docker Image Update Complete ===${NC}"
echo "The Docker image has been rebuilt with the latest dependencies"
echo "Recommendations:"
echo "1. Run tests to ensure everything still works"
echo "2. Check for any security issues reported above"
echo "3. If all is well, commit and push your changes"
echo echo
echo "The Docker image has been rebuilt with the latest dependencies."
echo
echo "Next steps:"
echo "1. Test the image: docker run --rm -it aprs:latest"
echo "2. If tests pass, tag and push the image to your registry"
echo "3. Deploy the updated image to your environment"
echo
echo -e "${YELLOW}Remember to update CI workflows if you've changed base image versions${NC}"
# Check if git is available and we're in a git repository # Check if git is available and we're in a git repository
if command -v git &> /dev/null && git rev-parse --is-inside-work-tree &> /dev/null; then if command -v git &> /dev/null && git rev-parse --is-inside-work-tree &> /dev/null 2>&1; then
echo "Git changes:" echo
git diff Dockerfile echo -e "${GREEN}Git status:${NC}"
git status -s
fi fi