Merge pull request #1840 from NASA-AMMOS/fix/security-updates-7-26

WIP - Dependency updates to fix vulnerabilities from security scans

Author: dandelany

action-server/Dockerfile

@@ -1,8 +1,11 @@
 FROM node:22.13.1-bookworm-slim
 
 # Install jemalloc
+# Update gnutls to pick up debian security fixes flagged by trivy (may not be needed after base image update)
 RUN apt-get update \
-    && apt-get install --no-install-recommends -y libjemalloc-dev
+    && apt-get install --no-install-recommends -y libjemalloc-dev \
+    && apt-get install --no-install-recommends -y --only-upgrade libgnutls30 \
+    && rm -rf /var/lib/apt/lists/*
 
 # Set the path for jemalloc
 RUN echo "/usr/lib/$(uname -m)-linux-gnu/libjemalloc.so" >> /etc/ld.so.preload

deployment/docker-compose.yml

@@ -220,7 +220,7 @@ services:
       HASURA_GRAPHQL_LOG_LEVEL: warn
       HASURA_GRAPHQL_METADATA_DATABASE_URL: "postgres://${AERIE_USERNAME}:${AERIE_PASSWORD}@postgres:5432/aerie_hasura"
       HASURA_GRAPHQL_METADATA_DIR: /hasura-metadata
-    image: "hasura/graphql-engine:v2.12.1.cli-migrations-v3"
+    image: "${REPOSITORY_DOCKER_URL}/aerie-hasura:${DOCKER_TAG}"
     ports: ["8080:8080"]
     restart: always
     volumes:
@@ -243,7 +243,7 @@ services:
       SCHEDULER_DB_PASSWORD: "${SCHEDULER_PASSWORD}"
       SEQUENCING_DB_USER: "${SEQUENCING_USERNAME}"
       SEQUENCING_DB_PASSWORD: "${SEQUENCING_PASSWORD}"
-    image: postgres:16.12-bookworm
+    image: "${REPOSITORY_DOCKER_URL}/aerie-postgres:${DOCKER_TAG}"
     ports: ["5432:5432"]
     restart: always
     volumes:

docker-compose.yml

@@ -277,6 +277,9 @@ services:
     volumes:
       - aerie_file_store:/usr/src/app/merlin_file_store:ro
   hasura:
+    build:
+      context: .
+      dockerfile: docker/Dockerfile.hasura
     container_name: aerie_hasura
     depends_on: ["postgres"]
     environment:
@@ -293,12 +296,15 @@ services:
       HASURA_GRAPHQL_LOG_LEVEL: info
       HASURA_GRAPHQL_METADATA_DATABASE_URL: "postgres://${AERIE_USERNAME}:${AERIE_PASSWORD}@postgres:5432/aerie_hasura"
       HASURA_GRAPHQL_METADATA_DIR: /hasura-metadata
-    image: "hasura/graphql-engine:v2.12.1.cli-migrations-v3"
+    image: aerie_hasura
     ports: ["8080:8080"]
     restart: always
     volumes:
       - ./deployment/hasura/metadata:/hasura-metadata
   postgres:
+    build:
+      context: .
+      dockerfile: docker/Dockerfile.postgres
     container_name: aerie_postgres
     environment:
       POSTGRES_DB: postgres
@@ -314,7 +320,7 @@ services:
       SCHEDULER_DB_PASSWORD: "${SCHEDULER_PASSWORD}"
       SEQUENCING_DB_USER: "${SEQUENCING_USERNAME}"
       SEQUENCING_DB_PASSWORD: "${SEQUENCING_PASSWORD}"
-    image: postgres:16.12-bookworm
+    image: aerie_postgres
     ports: ["5432:5432"]
     restart: always
     volumes:

docker/Dockerfile.postgres

@@ -1,2 +1,8 @@
-FROM postgres:16.12-bookworm
+FROM postgres:16.14-bookworm
+
+# Update gnutls to pick up debian security fixes flagged by trivy (may not be needed after base image update)
+RUN apt-get update \
+    && apt-get install --no-install-recommends -y --only-upgrade libgnutls30 \
+    && rm -rf /var/lib/apt/lists/*
+
 COPY deployment/postgres-init-db /docker-entrypoint-initdb.d

e2e-tests/docker-compose-many-workers.yml

@@ -219,6 +219,9 @@ services:
     volumes:
       - aerie_file_store:/usr/src/app/merlin_file_store:ro
   hasura:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.hasura
     container_name: aerie_hasura
     depends_on: ["postgres"]
     environment:
@@ -235,12 +238,15 @@ services:
       HASURA_GRAPHQL_LOG_LEVEL: info
       HASURA_GRAPHQL_METADATA_DATABASE_URL: "postgres://${AERIE_USERNAME}:${AERIE_PASSWORD}@postgres:5432/aerie_hasura"
       HASURA_GRAPHQL_METADATA_DIR: /hasura-metadata
-    image: "hasura/graphql-engine:v2.12.1.cli-migrations-v3"
+    image: aerie_hasura
     ports: ["8080:8080"]
     restart: always
     volumes:
       - ./deployment/hasura/metadata:/hasura-metadata
   postgres:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.postgres
     container_name: aerie_postgres
     environment:
       POSTGRES_DB: postgres
@@ -256,7 +262,7 @@ services:
       SCHEDULER_DB_PASSWORD: "${SCHEDULER_PASSWORD}"
       SEQUENCING_DB_USER: "${SEQUENCING_USERNAME}"
       SEQUENCING_DB_PASSWORD: "${SEQUENCING_PASSWORD}"
-    image: postgres:16.12-bookworm
+    image: aerie_postgres
     ports: ["5432:5432"]
     restart: always
     volumes:

e2e-tests/docker-compose-test.yml

@@ -264,6 +264,9 @@ services:
     volumes:
       - aerie_file_store:/usr/src/app/merlin_file_store:ro
   hasura:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.hasura
     container_name: hasura
     depends_on: ['postgres']
     environment:
@@ -279,12 +282,15 @@ services:
       HASURA_GRAPHQL_LOG_LEVEL: info
       HASURA_GRAPHQL_METADATA_DATABASE_URL: 'postgres://${AERIE_USERNAME}:${AERIE_PASSWORD}@postgres:5432/aerie_hasura'
       HASURA_GRAPHQL_METADATA_DIR: /hasura-metadata
-    image: 'hasura/graphql-engine:v2.12.1.cli-migrations-v3'
+    image: aerie_hasura
     ports: ['8080:8080']
     restart: always
     volumes:
       - ./../deployment/hasura/metadata:/hasura-metadata
   postgres:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.postgres
     container_name: postgres
     environment:
       POSTGRES_DB: postgres
@@ -300,7 +306,7 @@ services:
       SCHEDULER_DB_PASSWORD: "${SCHEDULER_PASSWORD}"
       SEQUENCING_DB_USER: "${SEQUENCING_USERNAME}"
       SEQUENCING_DB_PASSWORD: "${SEQUENCING_PASSWORD}"
-    image: postgres:16.12-bookworm
+    image: aerie_postgres
     ports: ['5432:5432']
     restart: always
     volumes:

sequencing-server/Dockerfile

@@ -1,8 +1,11 @@
 FROM node:18.20-bookworm-slim
 
 # Install jemalloc
+# Update gnutls to pick up debian security fixes flagged by trivy (may not be needed after base image update)
 RUN apt-get update \
-    && apt-get install --no-install-recommends -y libjemalloc-dev
+    && apt-get install --no-install-recommends -y libjemalloc-dev \
+    && apt-get install --no-install-recommends -y --only-upgrade libgnutls30 \
+    && rm -rf /var/lib/apt/lists/*
 
 # Set the path for jemalloc
 RUN echo "/usr/lib/$(uname -m)-linux-gnu/libjemalloc.so" >> /etc/ld.so.preload