Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use a more secure base-image for the Solr Operator docker image #294

Closed
HoustonPutman opened this issue Jul 21, 2021 · 1 comment · Fixed by #295
Closed

Use a more secure base-image for the Solr Operator docker image #294

HoustonPutman opened this issue Jul 21, 2021 · 1 comment · Fixed by #295
Labels
security TLS or Auth for Solr
Milestone

Comments

@HoustonPutman
Copy link
Contributor

HoustonPutman commented Jul 21, 2021

The security report for the Solr Operator Docker image on it's ArtifactHub page is not very good. This is due mostly to the fact that the base image contains multiple known vulnerabilities.

The current base image is gcr.io/distroless/base:debug-nonroot, and the vulnerabilities come from the fact that we are using the base image, not because it's a debug image. If we instead use gcr.io/distroless/static:debug-nonroot, these vulnerabilities go away.

The base image isn't the whole story. Some of the GoLang libraries that the Solr Operator depends on contain vulnerabilities as well, however removing those will require an upgrade of Kubernetes versions which we cannot currently do. Solving the base-image is the first, and larger, step.

@HoustonPutman
Copy link
Contributor Author

The difference between distroless/base and distroless/static is mainly for the purpose of including libc for go programs that use cgo, such as through the net package.

Since the Solr Operator is built with CGO_ENABLED=false, we do not need libc, so we should be find to base our image on distroless/static.

Kubebuilder uses distroless/static by default, so we should be safe with DNS resolution and Certificates when communicating within Kubernetes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security TLS or Auth for Solr
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant