fix(docker): Bump versions (python 3.11, alpine 3.20)

[kiblik]

Looks like Renovate and/or Dependabot are not able to identify higher versions

• If Debian names are used
• If 2 versions are mentioned in the tag

This should be addressed somehow, for now, let's fix it by hand.

Fix for #10277

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Configured Codepaths Analyzer	✅	0 findings
Sensitive Files Analyzer	✅	0 findings
AppSec Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The code changes in this pull request focus on updating the base Docker images used for the various components of the application, including the NGINX-based container, the Django-based container, and the integration test container. The primary updates are to the base Python image, which has been upgraded to the latest 3.11.9 version in most cases.

From an application security perspective, these changes are generally positive as they ensure the application is running on the most up-to-date and secure base images, which should include the latest security patches and bug fixes. Additionally, the Dockerfiles include various security-conscious practices, such as setting appropriate file permissions, managing sensitive environment variables, and running unit tests.

However, it's important to review the entire application and deployment process to ensure there are no other potential security vulnerabilities, such as issues with the NGINX configuration, the handling of static assets, or the installation and use of additional dependencies (e.g., Node.js and Yarn). Ongoing monitoring and maintenance of the application's security posture is also crucial to address any newly discovered vulnerabilities in the base images or the application's dependencies.

Files Changed:

1. Dockerfile.nginx-alpine: This file updates the base Python image from 3.11.3 to 3.11.9, which is a security and maintenance update. The Dockerfile sets up the build environment, installs necessary dependencies, and configures the NGINX container.

2. Dockerfile.integration-tests-debian: This Dockerfile updates the base Python image from 3.11.4 to 3.11.9 and installs Google Chrome and ChromeDriver for running integration tests. It also sets environment variables for the integration test environment.

3. Dockerfile.django-alpine: This Dockerfile updates the base Python image from 3.11.3 to 3.11.9 and installs additional dependencies required for the Django-based application. It sets up a dedicated user and appropriate file permissions.

4. Dockerfile.django-debian: This Dockerfile updates the base Python image from 3.11.4 to 3.11.9 and installs various package dependencies. It also sets environment variables and includes several entrypoint scripts.

5. Dockerfile.nginx-debian: This Dockerfile updates the base Python image from 3.11.4 to 3.11.9 and adds steps to install Node.js and Yarn for building and bundling the frontend assets. It also defines several environment variables related to the NGINX configuration.

Powered by DryRun Security

[mtesauro]

@kiblik I agree about bumping these to a later Alpine version but would like to stick with Python 3.11 since that's the tested version of Python.

I'd prefer to handle these one at a time - first do the Alpine part, then consider bumping the Python version instead of doing both in one PR.

Looking at the available Python 3.11 containers, this one seems to fit the bill:
https://hub.docker.com/layers/library/python/3.11.9-alpine/images/sha256-df44c0c0761ddbd6388f4549cab42d24d64d257c2a960ad5b276bb7dab9639c7?context=explore

And uses Alpine 20 so we'd be good to 2026. Once this PR is merged we can look at rev'ing the Python version separately.

I wanted to comment to let others chime in before requesting a change to python:3.11.9-alpine

[kiblik]

@kiblik I agree about bumping these to a later Alpine version but would like to stick with Python 3.11 since that's the tested version of Python.

I'd prefer to handle these one at a time - first do the Alpine part, then consider bumping the Python version instead of doing both in one PR.

Looking at the available Python 3.11 containers, this one seems to fit the bill: https://hub.docker.com/layers/library/python/3.11.9-alpine/images/sha256-df44c0c0761ddbd6388f4549cab42d24d64d257c2a960ad5b276bb7dab9639c7?context=explore

And uses Alpine 20 so we'd be good to 2026. Once this PR is merged we can look at rev'ing the Python version separately.

I wanted to comment to let others chime in before requesting a change to python:3.11.9-alpine

No problem @mtesauro. I updated all Pythons to 3.11.9 and all alpines to 3.20. PR is ready.

[mtesauro]

Approved