From cff70ac1ef8d3891274b907b1c8b2c795ed1f801 Mon Sep 17 00:00:00 2001 From: Lakshman Patel Date: Thu, 3 Sep 2026 05:47:57 +0530 Subject: [PATCH] fix(docker): bump runtime bases to patched digests for Trivy gate The Docker/Trivy CRITICAL/HIGH gate has been failing since 08-30 on all three hawk images (CVE-2026-56408, -66046, -76641 in expat < 2.8.3-2). The failing RUN apk/apt layers are cached via cache-from: type=gha, so re-running with the same base digest restores the vulnerable layer. - Dockerfile + Dockerfile.daemon: alpine:3.23.5@fd791d74 -> alpine:3.24@28bd5fe8 (libexpat 2.8.4-r0) - internal/sandbox/sandbox.Dockerfile: node:22-bookworm-slim@d649c27d -> @4d676821 (libexpat 2.8.3-2+) Each new digest invalidates the GHA cache so the package layer rebuilds with patched expat. Verified locally: the CI trivy command exits 0 on the rebuilt amd64+arm64 hawk images and the sandbox image. --- Dockerfile | 2 +- Dockerfile.daemon | 2 +- internal/sandbox/sandbox.Dockerfile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index a60275cb..cd4c5d2c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -49,7 +49,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \ -o hawk ./cmd/hawk # Runtime stage — Alpine (hawk requires git + bash for workspace operations; distroless excluded) -FROM alpine:3.23.5@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40 +FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b RUN apk upgrade --no-cache && \ apk add --no-cache ca-certificates git bash tini && \ diff --git a/Dockerfile.daemon b/Dockerfile.daemon index 5ed3b77e..1b6d132c 100644 --- a/Dockerfile.daemon +++ b/Dockerfile.daemon @@ -31,7 +31,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \ -X main.BuildDate=${BUILD_DATE}" \ -o hawk ./cmd/hawk -FROM alpine:3.23.5@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40 +FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b RUN apk upgrade --no-cache && \ apk add --no-cache ca-certificates git bash curl tini && \ diff --git a/internal/sandbox/sandbox.Dockerfile b/internal/sandbox/sandbox.Dockerfile index 949ce57f..7aa86c24 100644 --- a/internal/sandbox/sandbox.Dockerfile +++ b/internal/sandbox/sandbox.Dockerfile @@ -1,4 +1,4 @@ -FROM node:22-bookworm-slim@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436 +FROM node:22-bookworm-slim@sha256:4d676821dff059fd00d277ee4261ef34ea712317fed0737c03941481b5760c96 RUN npm install --global npm@12.0.2 && \ npm cache clean --force && \