Skip to content

Commit bebf4db

Browse files
lexfreilexfrei
authored
chore(build): refresh first-party Alpine runtime bases to 3.24 (#3009)
## What this PR does Moves the pinned Alpine runtime bases of the first-party images forward to `alpine:3.24`, clearing the published `musl` / `zlib` advisories carried by the stale layers. | image | base | | --- | --- | | mariadb-backup | 3.20 → 3.24 | | cozystack-operator | 3.22 → 3.24 | | platform-migrations | 3.22 → 3.24 | | grafana-dashboards | 3.22 → 3.24 | | kubeovn-webhook | 3.21.3 → 3.24 | | redis-operator | latest → 3.24 | Each runtime `apk` set was verified to resolve on `alpine:3.24`. These images rebuild on the release asset pipeline, which re-pins the digests in `values.yaml` on the next build — matching how the rest of the ~30 first-party images pick up the shared base (the issue's "rebuild and run the standard test pipeline"). **Scope notes:** - The build-only `alpine AS source` stages (keycloak-operator, objectstorage-controller) are left as-is: their final images are distroless, so no Alpine layer ships. - The s3manager base is owned by the separate bucket bump (#2887), and kilo's base moves in its own image rebuild (#2898). - **Side effect for platform-migrations**: its `kubectl` / `helm` come from the Alpine repo, so the base bump moves them `1.33 → 1.36` and `3.18 → 3.19`. Both are current upstream stable and in skew with the modern control plane for the migration scripts' operations (apply / get / label / helm release ops). Closes #2902 ### Release note ```release-note chore(images): refresh first-party Alpine runtime bases to 3.24 to clear the musl/zlib advisories ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated Alpine Linux base images across multiple application containers to version 3.24 (including backup utilities, platform/operator components, monitoring dashboards, and networking/webhook components) to improve security and build consistency. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 parents e83ba4e + 381edde commit bebf4db

6 files changed

Lines changed: 6 additions & 6 deletions

File tree

‎packages/apps/mariadb/images/mariadb-backup/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
FROM alpine:3.20
1+
FROM alpine:3.24
22
RUN apk add --no-cache mariadb-client uuidgen restic

‎packages/core/installer/images/cozystack-operator/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
1717
-o /cozystack-operator \
1818
./cmd/cozystack-operator
1919

20-
FROM alpine:3.22
20+
FROM alpine:3.24
2121

2222
COPY --from=builder /cozystack-operator /usr/bin/cozystack-operator
2323

‎packages/core/platform/images/migrations/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM alpine:3.22
1+
FROM alpine:3.24
22

33
RUN wget -O- https://github.com/cozystack/cozyhr/raw/refs/heads/main/hack/install.sh | sh -s -- -v 1.6.1
44

‎packages/system/grafana-operator/images/grafana-dashboards/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM alpine:3.22
1+
FROM alpine:3.24
22

33
RUN apk add --no-cache darkhttpd
44

‎packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go mod download
1010
COPY . .
1111
RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o webhook .
1212

13-
FROM alpine:3.21.3
13+
FROM alpine:3.24
1414
WORKDIR /app
1515

1616
COPY --from=builder /app/webhook /app/webhook

‎packages/system/redis-operator/images/redis-operator/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ RUN git apply /patches/*.diff
1414

1515
RUN GOOS=$TARGETOS GOARCH=$TARGETARCH VERSION=$VERSION ./scripts/build.sh
1616

17-
FROM alpine:latest
17+
FROM alpine:3.24
1818
RUN apk --no-cache add \
1919
ca-certificates
2020
COPY --from=builder /workspace/bin/redis-operator /usr/local/bin

0 commit comments

Comments
 (0)