paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 40 Packages Projects Releases Wiki Activity

Merge pull request #23335 from AmericanAirlines/chore--add-secure-base-image-dockerfile-alternative

Browse Source 
chore: add secure base image dockerfile alternative
This commit is contained in:
Patrik Oldsberg
2024-04-01 16:38:41 +02:00
committed by GitHub
parent b4ec65192a 28a267a65d
commit 601b99794f
3 changed files with 85 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment/docker.md
+12
View File
@@ -338,3 +338,15 @@ Here's an example of these flags in use:
```sh
docker image build . -f packages/backend/Dockerfile --tag backstage --progress=plain --no-cache
```
## Community Contributed Dockerfile Alternatives
The `Dockerfile` mentioned above located in `packages/backend` is maintained by the maintainers of Backstage, however there are also community contributed Dockerfile alternatives located in `contrib/docker`. The `Dockerfile`s in `contrib/docker` are not maintained by the maintainers of Backstage and are not necessarily updated when the `Dockerfile` located in `packages/backend` is updated.
### Minimal Hardened Image
A contributed `Dockerfile` exists within the directory of `contrib/docker/minimal-harded-image` which uses the [`wolfi-base`](https://github.com/wolfi-dev) image to reduce vulnerabilities. When this was contributed, this alternative `Dockerfile` reduced 98.2% of vulnerabilities in the built Backstage docker image when compared with the image built from `packages/backend/Dockerfile`.
To reduce maintenance, the digest of the image has been removed from the `contrib/docker/minimal-harded-image/Dockerfile` file. A complete example with the digest would be `cgr.dev/chainguard/wolfi-base:latest@sha256:3d6dece13cdb5546cd03b20e14f9af354bc1a56ab5a7b47dca3e6c1557211fcf` and it is suggested to update the `FROM` line in the `Dockerfile` to use a digest. Please do a docker pull on the image to get the latest digest. Using the digest allows tools such as Dependabot or Renovatebot to know exactly which image digest is being utilized and allows for Pull Requests to be triggered when a new digest is available.
It is suggested to setup Dependabot/Renovatebot or a smiliar tool to ensure the image is kept up to date so that vulnerability fixes that have been addressed are pulled in frequently.