System Dependency Updates for APRS.me Docker Image

This document outlines strategies for keeping system dependencies updated in the APRS.me Docker image without modifying the existing Dockerfile, which could potentially break the build process.

Current Challenges

The Dockerfile builds successfully but maintaining up-to-date system dependencies is important for security. Standard approaches like adding unattended-upgrades or using --security flags with apt-get have proven problematic in our build environment.

Recommended Approaches

1. Regular Rebuilds

The most reliable way to keep system dependencies updated is through regular rebuilds:

# Rebuild the Docker image with latest base image and dependencies
docker build --no-cache --pull -t aprs:latest .

Key flags:

--no-cache: Forces all layers to be rebuilt, including running apt-get update and apt-get upgrade
--pull: Ensures the latest version of the base image is used

2. Base Image Updates

Periodically update the base image version in the Dockerfile:

- ARG DEBIAN_VERSION=bullseye-20250520-slim
+ ARG DEBIAN_VERSION=bullseye-20250615-slim

The Debian team regularly releases updated images with security patches.

3. CI/CD Integration

Automate the update process:

Set up a weekly GitHub Actions workflow to:
- Build the image with --no-cache --pull
- Run security scans with Trivy
- Create a PR if updates are needed

Include base image version checks:

- name: Check for newer base image
  run: |
    # Logic to check for newer base image versions
    # Create PR if newer version available

4. Security Scanning

Regularly scan for vulnerabilities:

# Install Trivy
brew install aquasecurity/trivy/trivy  # macOS
# or appropriate command for your OS

# Scan the image
trivy image aprs:latest

5. Manual Update Script

#!/bin/bash
# update-deps.sh

# Pull latest base image
docker pull debian:$(grep 'DEBIAN_VERSION=' Dockerfile | cut -d'=' -f2 | tr -d '"')

# Rebuild with latest dependencies
docker build --no-cache --pull -t aprs:latest .

# Scan for vulnerabilities
if command -v trivy &> /dev/null; then
  trivy image aprs:latest
fi

echo "Image rebuilt with latest dependencies"

Deployment Strategy

Rebuild images at least weekly
Deploy updated images after testing
Monitor security advisories for critical updates
Perform out-of-band updates for critical CVEs

Monitoring

Set up alerts for high/critical vulnerabilities
Subscribe to security mailing lists for Debian and key packages
Use image scanning in your container registry

By following these approaches, you can maintain up-to-date system dependencies without modifying the Dockerfile in ways that might break the build process.

2.8 KiB Raw Blame History