Skip to content

chore: fix various security vulnerabilities in container-logger, docker-puller, docker-pusher, template-engine #686

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vadim-kharin-codefresh merged 5 commits into from
Apr 30, 2026
Merged

chore: fix various security vulnerabilities in container-logger, docker-puller, docker-pusher, template-engine #686

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a10bae1
chore: fix various security vulnerabilities in container-logger, dock…
vadim-kharin-codefresh Apr 29, 2026
21534b9
update pikolo to 0.15.0
vadim-kharin-codefresh Apr 29, 2026
fd9a31a
update changelog
vadim-kharin-codefresh Apr 29, 2026
c4e8aae
update helm docs
vadim-kharin-codefresh Apr 29, 2026
f087bf2
update helm docs
vadim-kharin-codefresh Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions charts/cf-runtime/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
apiVersion: v2
description: A Helm chart for Codefresh Runner
name: cf-runtime
version: 10.0.16
version: 10.0.17
keywords:
- codefresh
- runner
Expand All @@ -18,15 +18,15 @@ annotations:
# Supported kinds: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`:
artifacthub.io/changes: |
- kind: changed
description: 'update "cf-docker-builder" to v1.6.0'
description: 'update "container-logger" to 2.0.12'
- kind: changed
description: 'update "compose" to v5.1.3-1.6.3'
description: 'update "docker-puller" to 8.0.27'
- kind: changed
description: 'update "dind" to 29.4.1-3.0.14'
- kind: security
description: 'fix various security vulnerabilities in cf-docker-builder, compose and dind.'
description: 'update "docker-pusher" to 6.0.25'
- kind: changed
description: 'update "tonistiigi/binfmt" to qemu-v10.2.1'
description: 'update "template-engine" to 0.15.0'
- kind: security
description: 'fix various security vulnerabilities in container-logger, docker-puller, docker-pusher and template-engine'
dependencies:
- name: cf-common
repository: oci://quay.io/codefresh/charts
Expand Down
4 changes: 2 additions & 2 deletions charts/cf-runtime/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
## Codefresh Runner

![Version: 10.0.16](https://img.shields.io/badge/Version-10.0.16-informational?style=flat-square)
![Version: 10.0.17](https://img.shields.io/badge/Version-10.0.17-informational?style=flat-square)

Helm chart for deploying [Codefresh Runner](https://codefresh.io/docs/docs/installation/codefresh-runner/) to Kubernetes.

Expand Down Expand Up @@ -1351,7 +1351,7 @@ Install the Helm chart
| runtime.dind.userVolumeMounts | object | `{}` | Add extra volume mounts |
| runtime.dind.userVolumes | object | `{}` | Add extra volumes |
| runtime.dindDaemon | object | See below | DinD pod daemon config |
| runtime.engine | object | `{"affinity":{},"command":["node","dist/server/index.js"],"env":{"CF_TELEMETRY_LOGS_LEVEL":"debug","CF_TELEMETRY_OTEL_ALLOW_HTTP_INSTRUMENTATION":"false","CF_TELEMETRY_OTEL_ENABLE":"true","CF_TELEMETRY_PROMETHEUS_ENABLE":"false","CF_TELEMETRY_PROMETHEUS_ENABLE_PROCESS_METRICS":"false","CF_TELEMETRY_PROMETHEUS_HOST":"0.0.0.0","CF_TELEMETRY_PROMETHEUS_PORT":"9100","CF_TELEMETRY_PYROSCOPE_ENABLE":"false","CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_SCRAPE_TIMEOUT_MS":"0","OTEL_EXPORTER_OTLP_COMPRESSION":"gzip","OTEL_EXPORTER_OTLP_ENDPOINT":"http://localhost:4317","OTEL_EXPORTER_OTLP_PROTOCOL":"grpc","OTEL_EXPORTER_PROMETHEUS_HOST":"0.0.0.0","OTEL_EXPORTER_PROMETHEUS_PORT":"9464","OTEL_LOGS_EXPORTER":"none","OTEL_METRICS_EXPORTER":"otlp","OTEL_METRIC_EXPORT_INTERVAL":"10000","OTEL_METRIC_EXPORT_TIMEOUT":"5000","OTEL_SEMCONV_STABILITY_OPT_IN":"http","OTEL_TRACES_EXPORTER":"none","OTEL_TRACES_SAMPLER":"parentbased_always_on","PYROSCOPE_SERVER_ADDRESS":"","TRUSTED_QEMU_IMAGES":"tonistiigi/binfmt"},"image":{"digest":"sha256:c264a5f83156cbca2124930286bb584be09c060cd1b9739d6d0e0ebf0aa94065","pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"3.2.5"},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"resources":{"limits":{"cpu":"1000m","memory":"2048Mi"},"requests":{"cpu":"100m","memory":"128Mi"}},"runtimeImages":{"alpine":{"digest":"sha256:9a341ff2287c54b86425cbee0141114d811ae69d88a36019087be6d896cef241","registry":"docker.io","repository":"alpine","tag":"edge"},"compose":{"digest":"sha256:950ab2a3d8986f95ac84c0d67e5052f97c426bc487470c7b6f46c846a9bd78ac","registry":"quay.io","repository":"codefresh/compose","tag":"v5.1.3-1.6.3"},"container-logger":{"digest":"sha256:d5c028973cdb9ec7250014a2ced1ed31106fc5c1010207a7d08cd7099058aaf2","registry":"quay.io","repository":"codefresh/cf-container-logger","tag":"2.0.10"},"cosign-image-signer":{"digest":"sha256:85ce347ad7b11a7e324ca64e38b0701bc6fb739bfcbb67a3b4657ef36939e623","registry":"quay.io","repository":"codefresh/cf-cosign-image-signer","tag":"3.0.6-cf.1"},"default-qemu":{"digest":"sha256:d3b963f787999e6c0219a48dba02978769286ff61a5f4d26245cb6a6e5567ea3","registry":"docker.io","repository":"tonistiigi/binfmt","tag":"qemu-v10.2.1"},"docker-builder":{"digest":"sha256:31c605a6df7898e1e35ca57dcbe47ee314903ba28aab651cb6913ba43ade21a2","registry":"quay.io","repository":"codefresh/cf-docker-builder","tag":"1.6.0"},"docker-puller":{"digest":"sha256:a518ca194d85d5f254954f201e33f6cd4cd1a82d552fce8cdceabbaf12786cb3","registry":"quay.io","repository":"codefresh/cf-docker-puller","tag":"8.0.26"},"docker-pusher":{"digest":"sha256:199053e81fbba18363f4f7081b48b6da61b02d794ff8a914707710cd867bed96","registry":"quay.io","repository":"codefresh/cf-docker-pusher","tag":"6.0.24"},"fs-ops":{"digest":"sha256:5f954c1f4618dbcebf1c3ef7b9185c6e1c9bb14b0aad3d2830cfeb715541bf47","registry":"quay.io","repository":"codefresh/fs-ops","tag":"1.2.12"},"gc-builder":{"digest":"sha256:73d0bab42a59381b7b4894c6461f579083f48895906e17a3ac4e828044217fe0","registry":"quay.io","repository":"codefresh/gcloud-builder","tag":"0.5.8"},"git-cloner":{"digest":"sha256:7270f5c451b72fce34d358a1a7b377c43bc9a28959f3771d5dd666959fb18177","registry":"quay.io","repository":"codefresh/cf-git-cloner","tag":"10.3.10"},"kube-deploy":{"digest":"sha256:beb578bbe5bbf66c034c51937c909d16faf473225815ce416188176d363ec15d","registry":"quay.io","repository":"codefresh/cf-deploy-kubernetes","tag":"17.0.4"},"pipeline-debugger":{"digest":"sha256:2dbf79a87f641507fc2111d4ff01e046954bca2f31e41ebc1e9cda96b1189780","registry":"quay.io","repository":"codefresh/cf-debugger","tag":"1.3.13"},"template-engine":{"digest":"sha256:fc1dc409ceef47ffdc5a8779851ac201c8c0322fea1b80d0cb6a0a99da9c4c6b","registry":"quay.io","repository":"codefresh/pikolo","tag":"0.14.11"}},"runtimeImagesRegistry":"","schedulerName":"","serviceAccount":"codefresh-engine","terminationGracePeriodSeconds":180,"tolerations":[],"userEnvVars":[],"workflowLimits":{"MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS":600,"MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION":86400,"MAXIMUM_ELECTED_STATE_AGE_ALLOWED":900,"MAXIMUM_POST_STEPS_GRACE_PERIOD_MINUTES":30,"MAXIMUM_RETRY_ATTEMPTS_ALLOWED":20,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED":900,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE":300,"TIME_ENGINE_INACTIVE_UNTIL_TERMINATION":300,"TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY":60,"TIME_INACTIVE_UNTIL_TERMINATION":2700}}` | Parameters for Engine pod (aka "pipeline" orchestrator). |
| runtime.engine | object | `{"affinity":{},"command":["node","dist/server/index.js"],"env":{"CF_TELEMETRY_LOGS_LEVEL":"debug","CF_TELEMETRY_OTEL_ALLOW_HTTP_INSTRUMENTATION":"false","CF_TELEMETRY_OTEL_ENABLE":"true","CF_TELEMETRY_PROMETHEUS_ENABLE":"false","CF_TELEMETRY_PROMETHEUS_ENABLE_PROCESS_METRICS":"false","CF_TELEMETRY_PROMETHEUS_HOST":"0.0.0.0","CF_TELEMETRY_PROMETHEUS_PORT":"9100","CF_TELEMETRY_PYROSCOPE_ENABLE":"false","CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_SCRAPE_TIMEOUT_MS":"0","OTEL_EXPORTER_OTLP_COMPRESSION":"gzip","OTEL_EXPORTER_OTLP_ENDPOINT":"http://localhost:4317","OTEL_EXPORTER_OTLP_PROTOCOL":"grpc","OTEL_EXPORTER_PROMETHEUS_HOST":"0.0.0.0","OTEL_EXPORTER_PROMETHEUS_PORT":"9464","OTEL_LOGS_EXPORTER":"none","OTEL_METRICS_EXPORTER":"otlp","OTEL_METRIC_EXPORT_INTERVAL":"10000","OTEL_METRIC_EXPORT_TIMEOUT":"5000","OTEL_SEMCONV_STABILITY_OPT_IN":"http","OTEL_TRACES_EXPORTER":"none","OTEL_TRACES_SAMPLER":"parentbased_always_on","PYROSCOPE_SERVER_ADDRESS":"","TRUSTED_QEMU_IMAGES":"tonistiigi/binfmt"},"image":{"digest":"sha256:c264a5f83156cbca2124930286bb584be09c060cd1b9739d6d0e0ebf0aa94065","pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"3.2.5"},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"resources":{"limits":{"cpu":"1000m","memory":"2048Mi"},"requests":{"cpu":"100m","memory":"128Mi"}},"runtimeImages":{"alpine":{"digest":"sha256:9a341ff2287c54b86425cbee0141114d811ae69d88a36019087be6d896cef241","registry":"docker.io","repository":"alpine","tag":"edge"},"compose":{"digest":"sha256:950ab2a3d8986f95ac84c0d67e5052f97c426bc487470c7b6f46c846a9bd78ac","registry":"quay.io","repository":"codefresh/compose","tag":"v5.1.3-1.6.3"},"container-logger":{"digest":"sha256:d666502f8bb95a00a1a598dd33ccdd10927ae73d32a5eed278d476bb1c7140a4","registry":"quay.io","repository":"codefresh/cf-container-logger","tag":"2.0.12"},"cosign-image-signer":{"digest":"sha256:85ce347ad7b11a7e324ca64e38b0701bc6fb739bfcbb67a3b4657ef36939e623","registry":"quay.io","repository":"codefresh/cf-cosign-image-signer","tag":"3.0.6-cf.1"},"default-qemu":{"digest":"sha256:d3b963f787999e6c0219a48dba02978769286ff61a5f4d26245cb6a6e5567ea3","registry":"docker.io","repository":"tonistiigi/binfmt","tag":"qemu-v10.2.1"},"docker-builder":{"digest":"sha256:31c605a6df7898e1e35ca57dcbe47ee314903ba28aab651cb6913ba43ade21a2","registry":"quay.io","repository":"codefresh/cf-docker-builder","tag":"1.6.0"},"docker-puller":{"digest":"sha256:818773818053553505afbaf109bf67f1b22bdb80307e155d27d4f06eab3c3246","registry":"quay.io","repository":"codefresh/cf-docker-puller","tag":"8.0.27"},"docker-pusher":{"digest":"sha256:711ff93efa44135195466b3338ece12e1322e68dc742fb1e23e75ad0701a3696","registry":"quay.io","repository":"codefresh/cf-docker-pusher","tag":"6.0.25"},"fs-ops":{"digest":"sha256:5f954c1f4618dbcebf1c3ef7b9185c6e1c9bb14b0aad3d2830cfeb715541bf47","registry":"quay.io","repository":"codefresh/fs-ops","tag":"1.2.12"},"gc-builder":{"digest":"sha256:73d0bab42a59381b7b4894c6461f579083f48895906e17a3ac4e828044217fe0","registry":"quay.io","repository":"codefresh/gcloud-builder","tag":"0.5.8"},"git-cloner":{"digest":"sha256:7270f5c451b72fce34d358a1a7b377c43bc9a28959f3771d5dd666959fb18177","registry":"quay.io","repository":"codefresh/cf-git-cloner","tag":"10.3.10"},"kube-deploy":{"digest":"sha256:beb578bbe5bbf66c034c51937c909d16faf473225815ce416188176d363ec15d","registry":"quay.io","repository":"codefresh/cf-deploy-kubernetes","tag":"17.0.4"},"pipeline-debugger":{"digest":"sha256:2dbf79a87f641507fc2111d4ff01e046954bca2f31e41ebc1e9cda96b1189780","registry":"quay.io","repository":"codefresh/cf-debugger","tag":"1.3.13"},"template-engine":{"digest":"sha256:10f61a9c9eac46d4db982b42f9af1e21a3bcd9f283943a9025ff50f2308a1861","registry":"quay.io","repository":"codefresh/pikolo","tag":"0.15.0"}},"runtimeImagesRegistry":"","schedulerName":"","serviceAccount":"codefresh-engine","terminationGracePeriodSeconds":180,"tolerations":[],"userEnvVars":[],"workflowLimits":{"MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS":600,"MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION":86400,"MAXIMUM_ELECTED_STATE_AGE_ALLOWED":900,"MAXIMUM_POST_STEPS_GRACE_PERIOD_MINUTES":30,"MAXIMUM_RETRY_ATTEMPTS_ALLOWED":20,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED":900,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE":300,"TIME_ENGINE_INACTIVE_UNTIL_TERMINATION":300,"TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY":60,"TIME_INACTIVE_UNTIL_TERMINATION":2700}}` | Parameters for Engine pod (aka "pipeline" orchestrator). |
| runtime.engine.affinity | object | `{}` | Set affinity |
| runtime.engine.command | list | `["node","dist/server/index.js"]` | Set container command. |
| runtime.engine.env | object | `{"CF_TELEMETRY_LOGS_LEVEL":"debug","CF_TELEMETRY_OTEL_ALLOW_HTTP_INSTRUMENTATION":"false","CF_TELEMETRY_OTEL_ENABLE":"true","CF_TELEMETRY_PROMETHEUS_ENABLE":"false","CF_TELEMETRY_PROMETHEUS_ENABLE_PROCESS_METRICS":"false","CF_TELEMETRY_PROMETHEUS_HOST":"0.0.0.0","CF_TELEMETRY_PROMETHEUS_PORT":"9100","CF_TELEMETRY_PYROSCOPE_ENABLE":"false","CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_SCRAPE_TIMEOUT_MS":"0","OTEL_EXPORTER_OTLP_COMPRESSION":"gzip","OTEL_EXPORTER_OTLP_ENDPOINT":"http://localhost:4317","OTEL_EXPORTER_OTLP_PROTOCOL":"grpc","OTEL_EXPORTER_PROMETHEUS_HOST":"0.0.0.0","OTEL_EXPORTER_PROMETHEUS_PORT":"9464","OTEL_LOGS_EXPORTER":"none","OTEL_METRICS_EXPORTER":"otlp","OTEL_METRIC_EXPORT_INTERVAL":"10000","OTEL_METRIC_EXPORT_TIMEOUT":"5000","OTEL_SEMCONV_STABILITY_OPT_IN":"http","OTEL_TRACES_EXPORTER":"none","OTEL_TRACES_SAMPLER":"parentbased_always_on","PYROSCOPE_SERVER_ADDRESS":"","TRUSTED_QEMU_IMAGES":"tonistiigi/binfmt"}` | Set additional env vars. |
Expand Down
16 changes: 8 additions & 8 deletions charts/cf-runtime/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -535,8 +535,8 @@ runtime:
container-logger:
registry: quay.io
repository: codefresh/cf-container-logger
tag: 2.0.10
digest: sha256:d5c028973cdb9ec7250014a2ced1ed31106fc5c1010207a7d08cd7099058aaf2
tag: 2.0.12
digest: sha256:d666502f8bb95a00a1a598dd33ccdd10927ae73d32a5eed278d476bb1c7140a4
docker-builder:
registry: quay.io
repository: codefresh/cf-docker-builder
Expand All @@ -545,13 +545,13 @@ runtime:
docker-puller:
registry: quay.io
repository: codefresh/cf-docker-puller
tag: 8.0.26
digest: sha256:a518ca194d85d5f254954f201e33f6cd4cd1a82d552fce8cdceabbaf12786cb3
tag: 8.0.27
digest: sha256:818773818053553505afbaf109bf67f1b22bdb80307e155d27d4f06eab3c3246
docker-pusher:
registry: quay.io
repository: codefresh/cf-docker-pusher
tag: 6.0.24
digest: sha256:199053e81fbba18363f4f7081b48b6da61b02d794ff8a914707710cd867bed96
tag: 6.0.25
digest: sha256:711ff93efa44135195466b3338ece12e1322e68dc742fb1e23e75ad0701a3696
fs-ops:
registry: quay.io
repository: codefresh/fs-ops
Expand All @@ -575,8 +575,8 @@ runtime:
template-engine:
registry: quay.io
repository: codefresh/pikolo
tag: 0.14.11
digest: sha256:fc1dc409ceef47ffdc5a8779851ac201c8c0322fea1b80d0cb6a0a99da9c4c6b
tag: 0.15.0
digest: sha256:10f61a9c9eac46d4db982b42f9af1e21a3bcd9f283943a9025ff50f2308a1861
cosign-image-signer:
registry: quay.io
repository: codefresh/cf-cosign-image-signer
Expand Down
Loading