🔧(docker) harden the Dockerfile#782
Merged
Merged
Conversation
Address the maintainability findings raised by the new SonarCloud docker analyzer: drop the floating pip upgrade (nothing uses pip in the image, the build relies on uv, and the base image already ships a current pip), stop storing apk indexes in the image layers, quote DRIVE_STATIC_ROOT and sort the core package list.
kernicPanel
force-pushed
the
fix/dockerfile-hardening
branch
from
July 21, 2026 16:38
a137642 to
663cd49
Compare
NathanVss
approved these changes
Jul 22, 2026
Next 15.5.18, Vite 6.4.3 and Turbo 2.9.14 patch several advisories: Next.js server components denial of service (GHSA-26hh-7cqf-hhc6), Vite server.fs.deny bypass (GHSA-fx2h-pf6j-xcff) and Turbo local code execution on untrusted repositories (GHSA-3qcw-2rhx-2726).
Rebase the backend image on python:3.13.14-alpine (Alpine 3.24) to pull the patched openssl fixing CVE-2026-31789. Stays within the pinned 3.13 runtime, so no dependency re-resolution is needed.
Bump the transitive idna to 3.18 to fix GHSA-65pc-fj4g-8rjx, where crafted input to idna.encode() bypasses the CVE-2024-3651 mitigation.
Bump django to 5.2.15 to fix GHSA-mm6v-q8q9-pgcf.
Raise the transitive pillow constraint to 12.3.0 to fix CVE-2026-54058 (GHSA-pg7v-jwj7-p798), flagged by the trivy scan on the backend image.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
The SonarCloud docker analyzer now scans the Dockerfile and fails the
quality gate of any PR touching it (see #773) with findings that
predate those PRs.
Proposal
build relies on uv) and the base image ships its own pip, refreshed
on every base image bump
in the image layers
Deliberately not addressed (to be marked "Accepted" in SonarCloud):
uv sync --no-build: sdists may need building on alpine/muslbump PR