Skip to content

fix(security): container autofix for pegaprox #440

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mkellermann97 merged 2 commits into from
May 21, 2026
Merged

fix(security): container autofix for pegaprox #440

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7bac764
fix(security): container autofix for pegaprox
aikido-autofix[bot] May 21, 2026
94689ff
Merge pull request #439 from PegaProx/fix/aikido-security-container-f…
mkellermann97 May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM python:3.12-slim
FROM python:3.12-slim@sha256:9d3abd9fc11d06998ccdbdd93b4dd49b5ad7d67fcbbc11c016eb0eb2c2194891

LABEL org.label-schema.name="PegaProx"
LABEL org.label-schema.description="Modern Multi-Cluster Management for Proxmox VE"
Expand All @@ -8,7 +8,7 @@ LABEL org.label-schema.vcs-url="https://github.com/PegaProx/project-pegaprox"
LABEL maintainer="support@pegaprox.com"

# Install system dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \

@qodo-code-review qodo-code-review Bot May 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Non-reproducible image builds 🐞 Bug ☼ Reliability

The Docker build now runs apt-get upgrade -y, so rebuilding the same git SHA later can produce a
different image depending on whatever Debian packages are current at build time. This undermines the
intended determinism/provenance benefit of pinning the base image by digest and makes published
images harder to debug/audit.
Agent Prompt 
## Issue description
`apt-get upgrade -y` during `docker build` makes the resulting image depend on the state of Debian repositories at build time, so the same source commit can yield different images.

## Issue Context
The repo publishes images from CI; reproducible rebuilds are important for provenance and debugging.

## Fix Focus Areas
- Dockerfile[11-14]

## Suggested fix
- Remove `apt-get upgrade -y` from the build step.
- Keep `apt-get update && apt-get install ...` for required packages.
- If the goal is security patching, prefer updating the pinned base image digest regularly (and/or pin explicit Debian package versions instead of upgrading everything implicitly).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

gcc libffi-dev libssl-dev \
openssh-client sshpass \
&& rm -rf /var/lib/apt/lists/*
Expand Down
Loading