paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 32 Packages Projects Releases Wiki Activity

Merge pull request #24309 from AmericanAirlines/docs(contrib-docker)--update-readme-on-minimal-hardened-image-and-update-path

Browse Source 
docs(contrib docker): update readme on minimal hardened image and update path
This commit is contained in:
Patrik Oldsberg
2024-05-01 16:11:04 +02:00
committed by GitHub
parent 6154829cee b55f026d43
commit 45923b4e40
5 changed files with 28 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
contrib/docker/minimal-harded-image/README.md
-12
View File
@@ -1,12 +0,0 @@
# Minimal Hardened Image for Backstage
DockerHub images in general did not seem ideal for Backstage as the number of vulnerabilities were quite high regardless of the image used.
The `Dockerfile` in this directory uses a [`wolfi-base`](https://github.com/wolfi-dev) image from Chainguard Images. This improves the security of the application and reduces false positives in scanners.
## Considerations
- `Wolfi` only releases the `latest` tag for public consumption however digests can be pinned.
- `Wolfi` OS uses packages from the [os repository](https://github.com/wolfi-dev/os) on GitHub. Some packages may be named differently.
- While `Wolfi` uses `apk`, the OS is designed to support `glibc`.
- Due to the stripped down nature of the base image, additional packages might be needed compared to a distribution like Debian or Ubuntu.
contrib/docker/minimal-harded-image/Dockerfile → contrib/docker/minimal-hardened-image/Dockerfile
View File
contrib/docker/minimal-hardened-image/README.md
+25
View File
@@ -0,0 +1,25 @@
# Minimal Hardened Image for Backstage
DockerHub images in general did not seem ideal for Backstage as the number of vulnerabilities were quite high regardless of the image used.
The `Dockerfile` in this directory uses a [wolfi-base](https://github.com/wolfi-dev) image from Chainguard Images. This improves the security of the application and reduces false positives in scanners.
## Pinning Digest
To reduce maintenance, the digest of the image has been removed from the `./Dockerfile` file. A complete example with the digest would be `cgr.dev/chainguard/wolfi-base:latest@sha256:3d6dece13cdb5546cd03b20e14f9af354bc1a56ab5a7b47dca3e6c1557211fcf` and it is suggested to update the `FROM` line in the `Dockerfile` to use a digest.
Using the digest allows tools such as Dependabot or Renovate to know exactly which image digest is being utilized and allows for Pull Requests to be triggered when a new digest is available. It is suggested to setup Dependabot/Renovate or a similar tool to ensure the image is kept up to date so that vulnerability fixes that have been addressed are pulled in frequently.
### Obtaining Digest
To obtain the latest digest, perform a `docker pull` on the image to get the latest digest in the command output or use `crane digest <image>`.
## Considerations
- Wolfi only releases the `latest` tag for public consumption however digests can be pinned.
- Wolfi OS uses packages from the [os repository](https://github.com/wolfi-dev/os) on GitHub.
- Some packages may be named differently.
- While Wolfi uses `apk`, the OS is designed to support `glibc`.
- Due to the stripped down nature of the base image, additional packages might be needed compared to a distribution like Debian or Ubuntu.
- Chainguard will maintain one version of each Wolfi package at a time, which will track the latest version of the upstream software in the package. Chainguard will end patch support for previous versions of packages in Wolfi. [Read more here](https://edu.chainguard.dev/chainguard/chainguard-images/faq/#what-packages-are-available-in-chainguard-images)
- It is encouraged to use a relative pin or use a third-party tool to ensure the packages are kept up to date