Enable testcontainers tests once ryuk docker image is replaced with some less vulnerable

[dnestoro]

After implementing the feature that disables docker pull for docker images that are not listed in Allowed docker images list, it is discovered that Testcontainers test uses testcontainers/ryuk image under the hood. This image has been scanned (alongside other allowed docker images from the list) with grype tool, which found that this image contains many high/critical vulnerabilities. Since this image is used by default in testcontainers, we cannot prevent its download. Until testcontainers replace usage of this image with some less vulnerable, we have to disable this test.

Once the image is changed, we can enable this test again.

[mdelapenya]

Hi @dnestoro let me share that past week testcontainers/ryuk:0.4.0 was released removing all those security issues:

➜ grype testcontainers/ryuk:0.4.0 --scope all-layers
 ✔ Vulnerability DB        [no update available]
 ✔ Loaded image            
 ✔ Parsed image            
 ✔ Cataloged packages      [41 packages]
 ✔ Scanning image...       [0 vulnerabilities]
   ├── 0 critical, 0 high, 0 medium, 0 low, 0 negligible
   └── 0 fixed

No vulnerabilities found

All language implementations of Testcontainers are not using that version in the current releases yet. But there is a workaround to use a different image for Ryuk: https://www.testcontainers.org/features/configuration/#customizing-ryuk-resource-reaper

At ${HOME}/.testcontainers.properties:

ryuk.container.image = testcontainers/ryuk:0.4.0

or if you prefer using the env:

export RYUK_CONTAINER_IMAGE=testcontainers/ryuk:0.4.0

Hope it helps in bypassing those security issues described in this ticket 🙏

[eddumelendez]

testcontainers-java next release will contain testcontainers/ryuk:0.4.0 by default. See testcontainers/testcontainers-java#6782

[dnestoro]

This is fantastic! Thank you @mdelapenya and @eddumelendez! Do you possibly know when we can expect a new release?

[alvarosanchez]

My question is: do we really need Ryuk in CI? At Micronaut we disable it with the env TESTCONTAINERS_RYUK_DISABLED since the containers will be destroyed anyway when CI finishes.

[wirthi]

Disabling it is a good step, but we would still download it then, the vulnerability scanner would still find it.

[bsideup]

@alvarosanchez FYI if you disable Ryuk then an in-JVM ShutdownHook-based implementation will still be used :)

[linghengqian]

• I opened a PR for this issue.