Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] libraries with CVEs that are not used by the project #298

Closed
MaticPoh opened this issue Dec 9, 2023 · 3 comments
Closed

[Security] libraries with CVEs that are not used by the project #298

MaticPoh opened this issue Dec 9, 2023 · 3 comments
Labels
bug Something isn't working

Comments

@MaticPoh
Copy link
Contributor

MaticPoh commented Dec 9, 2023

What happened?

A container should be as small as possible with only the necessary libraries to run, so I would like to warn against using a base image such as debian which has a set of libraries that may be necessary for those who use it but which have security flaws already listed in docker.
image

https://hub.docker.com/layers/library/debian/bullseye-slim/images/sha256-9af4db29e828a4d08c7819f9e0972e2dbdac575e73c6438630c83bd79f49c8aa?context=repo&tab=vulnerabilities

As these libraries are not used by revolt, I implemented distrolless which has other advantages such as being lighter but the main one is security so I strongly recommend using it follow the link to the PR.

#297

@MaticPoh MaticPoh added the bug Something isn't working label Dec 9, 2023
@insertish insertish moved this to 🏗 In Progress in Revolt Project Mar 28, 2024
@insertish
Copy link
Member

insertish commented Sep 9, 2024

Okay, turns this has some unintended consequences.
For whatever reason, the events server tends to use about half of our system resources using the distroless images.

gcr.io/distroless/cc-debian12:nonroot: stupidly high CPU usage; no obvious cause
debian:bookworm-slim: CPU usage is nominal; works as intended

argh i screwed up testing, creating a new issue

@insertish insertish moved this from 🏗 In Progress to 🚪 Blocked in Revolt Project Sep 9, 2024
@insertish
Copy link
Member

Investigating in #341

@insertish
Copy link
Member

It was a regression in Rust, closing this issue out since distroless images are indeed being used now.

@github-project-automation github-project-automation bot moved this from 🚪 Blocked to ✅ Done in Revolt Project Sep 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
Archived in project
Development

No branches or pull requests

2 participants