Skip to content

Commit 4a5ce60

Browse files
fix(docker): use eclipse-temurin 17.0.19 on Ubuntu 24.04 (noble) instead of 26.04 (resolute)
The previous commit moved the base image to eclipse-temurin:17.0.19_10-jre-resolute (Ubuntu 26.04). Comparing all three candidates with `trivy image --severity HIGH,CRITICAL`: - eclipse-temurin:17.0.9_9-jre-focal (Ubuntu 20.04, current): trivy reports 0 findings, but only because Ubuntu 20.04 is EOL and Canonical no longer publishes security advisories for it — trivy itself warns detection is "insufficient". This is consistent with Snyk (which doesn't rely on distro-published advisories) flagging real CVEs, per OpenAPITools#16791. - eclipse-temurin:17.0.19_10-jre-resolute (Ubuntu 26.04): 0 OS-package findings, and the OS itself is in-support. However its base layer bundles /usr/bin/pebble (Canonical's Go-based service manager, not a dpkg package), which carries 6 unpatched HIGH-severity CVEs (stale golang.org/x/net and stdlib crypto/x509, all with fixes already published upstream). Our entrypoint never invokes pebble, but it's still on disk and gets scanned, so it would likely reproduce the exact class of finding this fix is meant to close. - eclipse-temurin:17.0.19_10-jre-noble (Ubuntu 24.04 LTS, supported through 2029): same JRE 17.0.19 build, 0 HIGH/CRITICAL findings, no pebble binary, and a smaller image (89.9 MB vs 104.2 MB for resolute). Switch both Dockerfiles to the noble tag: it resolves the same focal/EOL problem as resolute without introducing a new set of live CVEs from a bundled binary we don't use, and Ubuntu 24.04 is a more conservative upgrade path than day-one 26.04. Refs OpenAPITools#16791
1 parent b6bd4be commit 4a5ce60

2 files changed

Lines changed: 2 additions & 2 deletions

File tree

modules/openapi-generator-cli/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM eclipse-temurin:17.0.19_10-jre-resolute
1+
FROM eclipse-temurin:17.0.19_10-jre-noble
22

33
ADD target/openapi-generator-cli.jar /opt/openapi-generator/modules/openapi-generator-cli/target/openapi-generator-cli.jar
44

modules/openapi-generator-online/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM eclipse-temurin:17.0.19_10-jre-resolute
1+
FROM eclipse-temurin:17.0.19_10-jre-noble
22

33
WORKDIR /generator
44

0 commit comments

Comments
 (0)