Commit 4a5ce60
committed
fix(docker): use eclipse-temurin 17.0.19 on Ubuntu 24.04 (noble) instead of 26.04 (resolute)
The previous commit moved the base image to eclipse-temurin:17.0.19_10-jre-resolute
(Ubuntu 26.04). Comparing all three candidates with `trivy image --severity
HIGH,CRITICAL`:
- eclipse-temurin:17.0.9_9-jre-focal (Ubuntu 20.04, current): trivy reports 0
findings, but only because Ubuntu 20.04 is EOL and Canonical no longer
publishes security advisories for it — trivy itself warns detection is
"insufficient". This is consistent with Snyk (which doesn't rely on
distro-published advisories) flagging real CVEs, per OpenAPITools#16791.
- eclipse-temurin:17.0.19_10-jre-resolute (Ubuntu 26.04): 0 OS-package
findings, and the OS itself is in-support. However its base layer bundles
/usr/bin/pebble (Canonical's Go-based service manager, not a dpkg package),
which carries 6 unpatched HIGH-severity CVEs (stale golang.org/x/net and
stdlib crypto/x509, all with fixes already published upstream). Our
entrypoint never invokes pebble, but it's still on disk and gets scanned,
so it would likely reproduce the exact class of finding this fix is meant
to close.
- eclipse-temurin:17.0.19_10-jre-noble (Ubuntu 24.04 LTS, supported through
2029): same JRE 17.0.19 build, 0 HIGH/CRITICAL findings, no pebble binary,
and a smaller image (89.9 MB vs 104.2 MB for resolute).
Switch both Dockerfiles to the noble tag: it resolves the same focal/EOL
problem as resolute without introducing a new set of live CVEs from a
bundled binary we don't use, and Ubuntu 24.04 is a more conservative upgrade
path than day-one 26.04.
Refs OpenAPITools#167911 parent b6bd4be commit 4a5ce60
2 files changed
Lines changed: 2 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | | - | |
| 1 | + | |
2 | 2 | | |
3 | 3 | | |
4 | 4 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | | - | |
| 1 | + | |
2 | 2 | | |
3 | 3 | | |
4 | 4 | | |
| |||
0 commit comments