Repository navigation
chore(docker): harden base image against container-scan CVEs (v3.8.40) - #5229
Conversation
apt-get upgrade -y in the base stage pulls security-patched trixie packages at build time, and npm install -g npm@latest refreshes the globally-bundled undici/tar inside the npm CLI. Together these clear the subset of GitHub container-scan CVE alerts that have an upstream fix available. None of the flagged CVEs are in the application dependency tree (app already resolves undici@8.5.0 / tar@7.5.16, both fixed); they live in the node:24-trixie-slim base layer and npm's own internals, and none are reachable from the proxy request surface at runtime. CVEs without a published fix (local-only TOCTOU, etc.) remain until the distro patches them and the image is rebuilt.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Dockerfile to upgrade base Debian packages and refresh the globally-installed npm to address container-scan CVEs. The review feedback suggests improving build reliability and determinism by adding DEBIAN_FRONTEND=noninteractive to the package upgrade command, removing a redundant cache-clearing command, and pinning the npm installation to a specific major version (npm@10) with optimization flags.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| RUN --mount=type=cache,target=/var/cache/apt,sharing=shared \ | ||
| --mount=type=cache,target=/var/lib/apt/lists,sharing=shared \ | ||
| apt-get update \ | ||
| && apt-get upgrade -y \ |
There was a problem hiding this comment.
Para evitar que o build trave ou falhe devido a prompts interativos de configuração durante a atualização de pacotes, é altamente recomendável adicionar DEBIAN_FRONTEND=noninteractive antes do comando apt-get upgrade.
Além disso, observe que como /var/lib/apt/lists está montado como cache (--mount=type=cache), o comando rm -rf /var/lib/apt/lists/* no final desta instrução RUN (na linha 16) limpará o cache persistente, anulando o propósito do cache mount. Como os cache mounts não são incluídos na imagem final de qualquer forma, você pode remover com segurança o rm -rf em uma refatoração futura para permitir a persistência correta do cache entre builds.
&& DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
| RUN npm install -g npm@latest \ | ||
| && npm cache clean --force |
There was a problem hiding this comment.
O uso de npm@latest não é determinístico e pode levar a falhas inesperadas no build se uma nova versão major do npm (ex: v11 ou v12) for lançada com alterações incompatíveis com o Node 24.
É mais seguro fixar a instalação em uma versão major compatível com o Node 24 (como npm@10). Adicionalmente, adicionar as flags --no-audit e --no-fund acelerará a instalação e reduzirá o ruído nos logs, mantendo a consistência com outras instalações globais do npm neste Dockerfile.
RUN npm install -g --no-audit --no-fund npm@10 \
&& npm cache clean --force
…-inference#5229) apt-get upgrade -y in the base stage pulls security-patched trixie packages at build time, and npm install -g npm@latest refreshes the globally-bundled undici/tar inside the npm CLI. Together these clear the subset of GitHub container-scan CVE alerts that have an upstream fix available. None of the flagged CVEs are in the application dependency tree (app already resolves undici@8.5.0 / tar@7.5.16, both fixed); they live in the node:24-trixie-slim base layer and npm's own internals, and none are reachable from the proxy request surface at runtime. CVEs without a published fix (local-only TOCTOU, etc.) remain until the distro patches them and the image is rebuilt.
Cherry-pick de #5228 para a release ativa v3.8.40.
No stage
basedoDockerfile:apt-get upgrade -y(pacotes Debian trixie já corrigidos) +npm install -g npm@latest(refresca undici/tar empacotados no npm global). Resolve a parcela acionável dos CVEs de container-scan do painel de code-scanning; nenhum deles está no código/deps do app (já emundici@8.5.0/tar@7.5.16, ambos corrigidos), nem é alcançável pela superfície de request em runtime.Validação: só
Dockerfile; build completo da imagem validado pelo job docker-publish do CI no merge. Detalhes completos em #5228.