Archived
james.maesandClaude Opus 5.5
a99a21a829
Trivy now reports CVE-2026-78667, CVE-2026-78669 and CVE-2026-97031 (HIGH, published 2026-10-08) in /usr/bin/pebble, which the Temurin Ubuntu 26.04 base builds with Go 1.26.7. The newest upstream base still ships the same pebble v1.32.2, and no package owns the file. Carl's entrypoint never runs it, so the image removes it and fails the build if a copy remains. The image scan and scripts/verify-security.py pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
1.4 KiB
Docker
29 lines
1.4 KiB
Docker
#
|
|
# Copyright (C) 2026 KofTwentyTwo
|
|
#
|
|
|
|
# Package the native distribution that passed application conformance and release checks.
|
|
# Supply a reviewed immutable digest through RUNTIME_IMAGE when qualifying a release.
|
|
ARG RUNTIME_IMAGE=eclipse-temurin:21-jre@sha256:d7051a45dd955e4d5d1db4d3f4269fe13d1c6dff8cc6b7ef89fc8577b96c1982
|
|
FROM ${RUNTIME_IMAGE}
|
|
# CVE-2026-84782: the pinned Temurin base predates Ubuntu's OpenSSL fix.
|
|
# Upgrade only the affected packages and fail closed below the reviewed fixed version.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends --only-upgrade \
|
|
libssl3t64 openssl openssl-provider-legacy \
|
|
&& for package in libssl3t64 openssl openssl-provider-legacy; do \
|
|
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' "$package")" \
|
|
ge '3.5.5-1ubuntu3.6' || exit 1; \
|
|
done \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
# CVE-2026-78667, CVE-2026-78669, CVE-2026-97031: the base ships the pebble service manager
|
|
# built with Go 1.26.7, and no package owns it to upgrade. Carl never runs it, so remove it
|
|
# and fail closed if any copy remains. Drop this once the base carries Go 1.26.9 or later.
|
|
RUN rm -f /usr/bin/pebble && ! command -v pebble >/dev/null
|
|
WORKDIR /app
|
|
COPY --chown=10001:10001 target/agent/ /app/
|
|
ENV JAVA_TOOL_OPTIONS="-XX:MaxRAMPercentage=75 -XX:+ExitOnOutOfMemoryError"
|
|
USER 10001:10001
|
|
EXPOSE 8090
|
|
ENTRYPOINT ["sh", "/app/bin/agent"]
|