Repository navigation
fix(rocprofiler-systems): fix Dockerfile Trivy misconfigurations - #14129
Merged
Merged
Conversation
✅ All Policy Checks Passed
📖 Need help? See the Policy FAQ for details on every check and how to fix failures. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Both Ubuntu package lists need explicit Python development headers to preserve binding builds against the system interpreter.
1 open issue
What changed in this PR
This PR isolates the rocprofiler-systems Dockerfile security-scan fixes from #13267, applying them to development and CI images while preserving root execution.
Changes:
- Disable recommended APT packages, explicitly install CA certificates, and clean package lists in Ubuntu images.
- Add or normalize openSUSE package-cache cleanup.
- Declare
USER rootwith a documented Trivy exception in all six images.
| File | Description |
|---|---|
projects/rocprofiler-systems/docker/Dockerfile.ubuntu.ci |
Update APT installs, certificates, cleanup, and root declaration. |
projects/rocprofiler-systems/docker/Dockerfile.ubuntu |
Update APT installs, certificates, cleanup, and root declaration. |
projects/rocprofiler-systems/docker/Dockerfile.rhel.ci |
Declare intentional root execution with a Trivy exception. |
projects/rocprofiler-systems/docker/Dockerfile.rhel |
Declare intentional root execution with a Trivy exception. |
projects/rocprofiler-systems/docker/Dockerfile.opensuse.ci |
Normalize cache cleanup and declare root execution. |
projects/rocprofiler-systems/docker/Dockerfile.opensuse |
Clean package caches and declare root execution. |
Review effort: Balanced
github-actions
Bot
added
the
github actions
Co-authored-by: Ciprian Goea <ciprian.goea@amd.com> Signed-off-by: David Galiffi <David.Galiffi@amd.com>
--no-install-recommends no longer pulls in Recommends, so install ca-certificates explicitly instead of relying on python3-pip's transitive dependency for the HTTPS downloads. Remove /var/lib/apt/lists in the same RUN that populates it so the cleanup actually shrinks the image, and run apt-get update before installing the amdgpu-install deb since the first RUN's lists are now removed. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: David Galiffi <David.Galiffi@amd.com>
Apply the same hardening as the non-CI Dockerfiles, which Trivy does not scan under the Dockerfile.*.ci names: add --no-install-recommends, install ca-certificates explicitly, clean apt lists in the same RUN, use plain `zypper clean --all`, and make the root user explicit with a DS-0002 ignore. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: David Galiffi <David.Galiffi@amd.com>
python3-dev was previously pulled in as a Recommends of python3-pip. With --no-install-recommends the Python headers are missing, which breaks the Development.Module lookup when building the Python bindings against the system interpreter. List it explicitly. Also sort the apt package lists alphabetically and wrap them at about 90 columns. No other packages are added or removed. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: David Galiffi <David.Galiffi@amd.com>
The systems-ci-multiarch image no longer ships /var/lib/apt/lists, so the Install MPI step must run apt-get update before installing libopenmpi-dev. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: David Galiffi <David.Galiffi@amd.com>
apt-get autoclean only removes obsolete cached packages and does almost nothing in a fresh image; clean removes all cached .deb files. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: David Galiffi <David.Galiffi@amd.com>
dgaliffiAMD
force-pushed
the
users/dgaliffi/trivy-fixes
branch
from
October 27, 2026 21:33
05edc81 to
f616bc5
Compare
mradosav-amd
approved these changes
Oct 28, 2026
jbonnell-amd
approved these changes
Oct 28, 2026
Contributor
TheRock Submodule Bump ActivityNewest first
|
1 task done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Fix the HIGH and CRITICAL Dockerfile misconfigurations that Trivy reports for
projects/rocprofiler-systems/docker, so these Dockerfiles pass the security scan gate.This splits the
rocprofiler-systemsportion out of #13267 ("security: fix all dockerfile related trivy issues") by @cgoea so it can be reviewed and merged with this project's changes on their own. The original commit is cherry-picked here with authorship credit preserved. The changes to other projects remain in #13267.Technical Details
projects/rocprofiler-systemschanges from security: fix all dockerfile related trivy issues #13267 (by Ciprian Goea):--no-install-recommendsonapt-get install(DS-0029)zypper clean --allafter installs in the openSUSE image (DS-0020)USER rootwith# trivy:ignore:DS-0002on these build/dev images, so the runtime user is unchangedca-certificatesexplicitly inDockerfile.ubuntu*, because--no-install-recommendsno longer pulls it in as a Recommends and the images download over HTTPS (wget).python3-devexplicitly inDockerfile.ubuntu*. It was previously pulled in as a Recommends ofpython3-pip, and without it theDevelopment.Modulelookup fails when building the Python bindings against the system interpreter./var/lib/apt/listsin the sameRUNthat creates it, and runapt-get updatebefore installing theamdgpu-install.deb, since the earlierRUN's lists are now removed.apt-get cleaninstead ofapt-get autocleaninDockerfile.ubuntu*, sinceautocleanremoves almost nothing in a fresh image.apt-get updatebeforeapt-get install libopenmpi-devin the "Install MPI" step ofrocprofiler-systems-continuous-integration.yml, because thesystems-ci-multiarchimage (built fromDockerfile.ubuntu.ci) no longer ships the apt lists.Dockerfile.{ubuntu,opensuse,rhel}.civariants. Trivy does not scan files namedDockerfile.*.ci, so they were not covered by the original PR. Scanning renamed copies showed the same failures as their non-CI counterparts.Issue Tracking
JIRA ID: ROCM-28051
JIRA ID: AIPROFSYST-830
Test Plan
Ran
trivy config --severity HIGH,CRITICAL --file-patterns "dockerfile:Dockerfile.*" docker/onprojects/rocprofiler-systems.The GPU CI job's "Install MPI" step only exercises the workflow change after the
systems-ci-multiarchimage is republished following merge, so it is not covered by this PR's CI.Test Result
Before: the
.cifiles reported DS-0002, DS-0020 and DS-0029. After: 0 HIGH/CRITICAL findings on all six Dockerfiles. The images were not built locally; the container CI jobs for this PR cover the build.Submission Checklist