From 77dca26a83067fda3bd2459c788c0ebeaecc83e1 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Mon, 2 Nov 2026 08:30:59 -0800 Subject: [PATCH] fix(container): apt-get upgrade in the base layer to pick up OS security fixes Nothing in container/Dockerfile pins a version (gh, docker-ce-cli and Node come from their apt repos, pnpm/Playwright/uv/ruff/rustup/Claude Code/AWS CLI resolve latest), so a rebuild is what delivers fixes. Two things stood in the way: - `apt-get install` never upgrades packages the ubuntu:24.04 image already ships, so a noble-security fix stays out until Canonical refreshes the tag. The first apt layer now runs `apt-get upgrade -y` inside the existing retry pattern. - CI builds with `cache-from: type=gha`, so the layers only re-run when the base digest or a layer's text changes. Trivy on the published image (built 2026-10-16) found libbrotli1 1.1.0-2build2 (CVE-2026-111497, HIGH), zlib1g 1.3.dfsg-3.1ubuntu2.2 (CVE-2026-85091) and pnpm's bundled undici 6.29.0 (CVE-2026-109383, CVE-2026-109869, CVE-2026-87018, all HIGH). Changing this layer invalidates the cache once, so the next CI build rebuilds everything. A local `docker build --pull` of this tree succeeds (amd64). Trivy finds no fixable OS or Node vulnerabilities in it: Node 22.23.4, gh 2.103.3, docker CLI 29.9.2, AWS CLI 2.39.3, pnpm 12.16.1, Playwright 1.64.1, Claude Code 2.1.316. What remains is uv 0.13.6's bundled rustls 0.23.45 (GHSA-c8m5-c952-6cm4, MEDIUM). That is fixed on uv's main branch but not in a release yet. Co-Authored-By: Claude Opus 5.5 --- container/Dockerfile | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/container/Dockerfile b/container/Dockerfile index fc81ee9..ba4b9c8 100644 --- a/container/Dockerfile +++ b/container/Dockerfile @@ -28,12 +28,26 @@ ENV DEBIAN_FRONTEND=noninteractive # archive.ubuntu.com returns stale Packages.gz files with mismatched hashes # during hourly resyncs. Clearing /var/lib/apt/lists/* between attempts # forces a fresh fetch. +# +# `apt-get upgrade` is what picks up security fixes for packages the +# `ubuntu:24.04` image already ships. `install` below never touches those, so +# without it a fix that lands in noble-security between two refreshes of the +# base tag stays out of this image until the next refresh. Packages the later +# layers install come straight from the archive, so this one upgrade is enough. +# +# Note CI builds with `cache-from: type=gha`, so this layer (and everything +# after it) only re-runs when the base digest or this layer's text changes. +# Scanned on 2026-11-02, the published image of 2026-10-16 carried +# libbrotli1 1.1.0-2build2 (CVE-2026-111497, HIGH) and zlib1g 1.3.dfsg-3.1ubuntu2.2 +# (CVE-2026-85091), both with fixed versions in the archive, and pnpm's bundled +# undici 6.29.0 (three HIGH CVEs, fixed in the pnpm 12.16.1 a rebuild installs). RUN for i in 1 2 3 4 5; do \ apt-get -o Acquire::Retries=3 update && break; \ echo "apt-get update failed (attempt $i), retrying in 10s..."; \ rm -rf /var/lib/apt/lists/*; \ sleep 10; \ done \ + && apt-get -o Acquire::Retries=3 upgrade -y \ && apt-get install -y --no-install-recommends \ git \ curl \