From d1c325e1c7864aa0d65259a4100a3015b852d053 Mon Sep 17 00:00:00 2001 From: Karl Haworth Date: Tue, 16 Apr 2024 07:51:02 -0400 Subject: [PATCH 1/6] - update readme to include information on wolfi package strategy Signed-off-by: Karl Haworth --- contrib/docker/minimal-harded-image/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/contrib/docker/minimal-harded-image/README.md b/contrib/docker/minimal-harded-image/README.md index accb2188ac..5737cd3be0 100644 --- a/contrib/docker/minimal-harded-image/README.md +++ b/contrib/docker/minimal-harded-image/README.md @@ -10,3 +10,5 @@ The `Dockerfile` in this directory uses a [`wolfi-base`](https://github.com/wolf - `Wolfi` OS uses packages from the [os repository](https://github.com/wolfi-dev/os) on GitHub. Some packages may be named differently. - While `Wolfi` uses `apk`, the OS is designed to support `glibc`. - Due to the stripped down nature of the base image, additional packages might be needed compared to a distribution like Debian or Ubuntu. +- Chainguard will maintain one version of each Wolfi package at a time, which will track the latest version of the upstream software in the package. Chainguard will end patch support for previous versions of packages in Wolfi. [Read more here](https://edu.chainguard.dev/chainguard/chainguard-images/faq/#what-packages-are-available-in-chainguard-images) + - It is encouraged to use a relative pin or use a third-party tool to ensure the packages are kept up to date From 3ad8f49c1decfc5f1d78838581940e5c72e14421 Mon Sep 17 00:00:00 2001 From: Karl Haworth Date: Tue, 16 Apr 2024 07:51:23 -0400 Subject: [PATCH 2/6] add info on digests Signed-off-by: Karl Haworth --- contrib/docker/minimal-harded-image/README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/contrib/docker/minimal-harded-image/README.md b/contrib/docker/minimal-harded-image/README.md index 5737cd3be0..a4f19784d4 100644 --- a/contrib/docker/minimal-harded-image/README.md +++ b/contrib/docker/minimal-harded-image/README.md @@ -4,6 +4,16 @@ DockerHub images in general did not seem ideal for Backstage as the number of vu The `Dockerfile` in this directory uses a [`wolfi-base`](https://github.com/wolfi-dev) image from Chainguard Images. This improves the security of the application and reduces false positives in scanners. +## Pinning Digest + +To reduce maintenance, the digest of the image has been removed from the `./Dockerfile` file. A complete example with the digest would be `cgr.dev/chainguard/wolfi-base:latest@sha256:3d6dece13cdb5546cd03b20e14f9af354bc1a56ab5a7b47dca3e6c1557211fcf` and it is suggested to update the `FROM` line in the `Dockerfile` to use a digest. + +Using the digest allows tools such as Dependabot or Renovate to know exactly which image digest is being utilized and allows for Pull Requests to be triggered when a new digest is available. It is suggested to setup Dependabot/Renovate or a similar tool to ensure the image is kept up to date so that vulnerability fixes that have been addressed are pulled in frequently. + +### Obtaining Digest + +To obtain the latest digest, perform a `docker pull` on the image to get the latest digest in the command output or use `crane digest `. + ## Considerations - `Wolfi` only releases the `latest` tag for public consumption however digests can be pinned. From 4120800bd9e4b46c84b2e1b1436929b3f133eb07 Mon Sep 17 00:00:00 2001 From: Karl Haworth Date: Tue, 16 Apr 2024 07:51:40 -0400 Subject: [PATCH 3/6] - move path from `minimal-harded-image` -> `minimal-hardened-image` Signed-off-by: Karl Haworth --- .../Dockerfile | 0 .../README.md | 0 docs/deployment/docker.md | 4 ++-- 3 files changed, 2 insertions(+), 2 deletions(-) rename contrib/docker/{minimal-harded-image => minimal-hardened-image}/Dockerfile (100%) rename contrib/docker/{minimal-harded-image => minimal-hardened-image}/README.md (100%) diff --git a/contrib/docker/minimal-harded-image/Dockerfile b/contrib/docker/minimal-hardened-image/Dockerfile similarity index 100% rename from contrib/docker/minimal-harded-image/Dockerfile rename to contrib/docker/minimal-hardened-image/Dockerfile diff --git a/contrib/docker/minimal-harded-image/README.md b/contrib/docker/minimal-hardened-image/README.md similarity index 100% rename from contrib/docker/minimal-harded-image/README.md rename to contrib/docker/minimal-hardened-image/README.md diff --git a/docs/deployment/docker.md b/docs/deployment/docker.md index 791882224d..9ec5460a88 100644 --- a/docs/deployment/docker.md +++ b/docs/deployment/docker.md @@ -345,8 +345,8 @@ The `Dockerfile` mentioned above located in `packages/backend` is maintained by ### Minimal Hardened Image -A contributed `Dockerfile` exists within the directory of `contrib/docker/minimal-harded-image` which uses the [`wolfi-base`](https://github.com/wolfi-dev) image to reduce vulnerabilities. When this was contributed, this alternative `Dockerfile` reduced 98.2% of vulnerabilities in the built Backstage docker image when compared with the image built from `packages/backend/Dockerfile`. +A contributed `Dockerfile` exists within the directory of `contrib/docker/minimal-hardened-image` which uses the [`wolfi-base`](https://github.com/wolfi-dev) image to reduce vulnerabilities. When this was contributed, this alternative `Dockerfile` reduced 98.2% of vulnerabilities in the built Backstage docker image when compared with the image built from `packages/backend/Dockerfile`. -To reduce maintenance, the digest of the image has been removed from the `contrib/docker/minimal-harded-image/Dockerfile` file. A complete example with the digest would be `cgr.dev/chainguard/wolfi-base:latest@sha256:3d6dece13cdb5546cd03b20e14f9af354bc1a56ab5a7b47dca3e6c1557211fcf` and it is suggested to update the `FROM` line in the `Dockerfile` to use a digest. Please do a docker pull on the image to get the latest digest. Using the digest allows tools such as Dependabot or Renovate to know exactly which image digest is being utilized and allows for Pull Requests to be triggered when a new digest is available. +To reduce maintenance, the digest of the image has been removed from the `contrib/docker/minimal-hardened-image/Dockerfile` file. A complete example with the digest would be `cgr.dev/chainguard/wolfi-base:latest@sha256:3d6dece13cdb5546cd03b20e14f9af354bc1a56ab5a7b47dca3e6c1557211fcf` and it is suggested to update the `FROM` line in the `Dockerfile` to use a digest. Please do a docker pull on the image to get the latest digest. Using the digest allows tools such as Dependabot or Renovate to know exactly which image digest is being utilized and allows for Pull Requests to be triggered when a new digest is available. It is suggested to setup Dependabot/Renovate or a similar tool to ensure the image is kept up to date so that vulnerability fixes that have been addressed are pulled in frequently. From 9d089a421916cd366e2c669983bf2d8303d1061d Mon Sep 17 00:00:00 2001 From: Karl Haworth Date: Tue, 16 Apr 2024 07:52:35 -0400 Subject: [PATCH 4/6] change item to subbullet Signed-off-by: Karl Haworth --- contrib/docker/minimal-hardened-image/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/contrib/docker/minimal-hardened-image/README.md b/contrib/docker/minimal-hardened-image/README.md index a4f19784d4..c9a41d0d19 100644 --- a/contrib/docker/minimal-hardened-image/README.md +++ b/contrib/docker/minimal-hardened-image/README.md @@ -17,7 +17,8 @@ To obtain the latest digest, perform a `docker pull` on the image to get the lat ## Considerations - `Wolfi` only releases the `latest` tag for public consumption however digests can be pinned. -- `Wolfi` OS uses packages from the [os repository](https://github.com/wolfi-dev/os) on GitHub. Some packages may be named differently. +- `Wolfi` OS uses packages from the [os repository](https://github.com/wolfi-dev/os) on GitHub. + - Some packages may be named differently. - While `Wolfi` uses `apk`, the OS is designed to support `glibc`. - Due to the stripped down nature of the base image, additional packages might be needed compared to a distribution like Debian or Ubuntu. - Chainguard will maintain one version of each Wolfi package at a time, which will track the latest version of the upstream software in the package. Chainguard will end patch support for previous versions of packages in Wolfi. [Read more here](https://edu.chainguard.dev/chainguard/chainguard-images/faq/#what-packages-are-available-in-chainguard-images) From 79d91e06af741dd2701c69c1706859ceaad9ef2e Mon Sep 17 00:00:00 2001 From: Karl Haworth Date: Tue, 16 Apr 2024 11:48:32 -0500 Subject: [PATCH 5/6] add wolfi to vale accept list Signed-off-by: Karl Haworth --- .github/vale/config/vocabularies/Backstage/accept.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/vale/config/vocabularies/Backstage/accept.txt b/.github/vale/config/vocabularies/Backstage/accept.txt index b525d7e48e..77b144dbcb 100644 --- a/.github/vale/config/vocabularies/Backstage/accept.txt +++ b/.github/vale/config/vocabularies/Backstage/accept.txt @@ -462,6 +462,7 @@ Weaveworks Webpack widget's winston +Wolfi www WWW XCMetrics From b55f026d43b2c8a14b4c2340470bb9cdd7903271 Mon Sep 17 00:00:00 2001 From: Karl Haworth Date: Tue, 16 Apr 2024 11:49:12 -0500 Subject: [PATCH 6/6] remove backticks from 'wolfi' Signed-off-by: Karl Haworth --- contrib/docker/minimal-hardened-image/README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/contrib/docker/minimal-hardened-image/README.md b/contrib/docker/minimal-hardened-image/README.md index c9a41d0d19..62045a4ded 100644 --- a/contrib/docker/minimal-hardened-image/README.md +++ b/contrib/docker/minimal-hardened-image/README.md @@ -2,7 +2,7 @@ DockerHub images in general did not seem ideal for Backstage as the number of vulnerabilities were quite high regardless of the image used. -The `Dockerfile` in this directory uses a [`wolfi-base`](https://github.com/wolfi-dev) image from Chainguard Images. This improves the security of the application and reduces false positives in scanners. +The `Dockerfile` in this directory uses a [wolfi-base](https://github.com/wolfi-dev) image from Chainguard Images. This improves the security of the application and reduces false positives in scanners. ## Pinning Digest @@ -16,10 +16,10 @@ To obtain the latest digest, perform a `docker pull` on the image to get the lat ## Considerations -- `Wolfi` only releases the `latest` tag for public consumption however digests can be pinned. -- `Wolfi` OS uses packages from the [os repository](https://github.com/wolfi-dev/os) on GitHub. +- Wolfi only releases the `latest` tag for public consumption however digests can be pinned. +- Wolfi OS uses packages from the [os repository](https://github.com/wolfi-dev/os) on GitHub. - Some packages may be named differently. -- While `Wolfi` uses `apk`, the OS is designed to support `glibc`. +- While Wolfi uses `apk`, the OS is designed to support `glibc`. - Due to the stripped down nature of the base image, additional packages might be needed compared to a distribution like Debian or Ubuntu. - Chainguard will maintain one version of each Wolfi package at a time, which will track the latest version of the upstream software in the package. Chainguard will end patch support for previous versions of packages in Wolfi. [Read more here](https://edu.chainguard.dev/chainguard/chainguard-images/faq/#what-packages-are-available-in-chainguard-images) - It is encouraged to use a relative pin or use a third-party tool to ensure the packages are kept up to date