Bump alpine to 3.19 #1274
Bump alpine to 3.19 #1274
Conversation
Signed-off-by: Nick Slowinski <[email protected]>
|
Warning Rate Limit Exceeded@dyc3 has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 19 minutes and 32 seconds before requesting another review. How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. WalkthroughThe Dockerfile has been updated to use a newer version of the Alpine base image, transitioning from Changes
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Status
Actionable comments generated: 2
Configuration used: CodeRabbit UI
Files selected for processing (1)
- docker/Dockerfile (2 hunks)
Additional comments: 7
docker/Dockerfile (7)
- 1-1: The base image has been updated to
node:18-alpine3.19in the build stage, aligning with the PR's objective to address security vulnerabilities by upgrading to a more secure Alpine version.- 2-3: The
ARGandENVforGIT_COMMITare correctly retained, ensuring that the build metadata can be accurately tracked and associated with specific Git commits. This practice is essential for traceability and debugging.- 11-17: > 📝 NOTE
This review was outside the diff hunks and was mapped to the diff hunk with the greatest overlap. Original lines [8-13]
The build process includes running
yarnto install dependencies and thenyarn run buildto compile the application. Afterward,node_modulesis removed, andyarn install --production=trueis run to install only production dependencies. This is a good practice to reduce the size of the Docker image by excluding development dependencies in the production stage. However, ensure that this does not inadvertently exclude necessary dependencies for the application to run.
- 14-14: The base image for the production stage has also been updated to
node:18-alpine3.19, consistent with the update in the build stage. This ensures that both stages are using the same, secure version of Alpine.- 1-4: > 📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [20-20]
The inclusion of
FFPROBE_PATHenvironment variable is specific and necessary for applications that rely onffprobefor media processing. This explicit path setting ensures that the application can correctly locate and useffprobe. It's a good practice to explicitly define paths to binary dependencies in Docker environments to avoid path resolution issues.
- 1-4: > 📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [29-29]
The
HEALTHCHECKinstruction is a good practice, ensuring that the Docker container's health is monitored and managed by Docker. The use ofcurlto check the application's status endpoint is a straightforward and effective method. However, ensure that the application is configured to start and listen on the expected port (8080) before the health check runs to avoid false negatives.
- 1-4: > 📝 NOTE
This review was outside the diff hunks, and no overlapping diff hunk was found. Original lines [32-32]
The command to start the server is correctly specified, ensuring that the database is ready before starting the application. This is a good practice to ensure that the application does not start before its dependencies are ready. However, ensure that the
wait_for_db.shscript has appropriate error handling and timeout mechanisms to avoid indefinite waiting in case the database is not available.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #1274 +/- ##
================================================
+ Coverage 61.4479% 61.5784% +0.1304%
================================================
Files 118 118
Lines 9517 9427 -90
Branches 1158 1158
================================================
- Hits 5848 5805 -43
+ Misses 3669 3622 -47 ☔ View full report in Codecov by Sentry. |
|
Actually, I'll go ahead and do it so we can get this merged |
|
Sounds good. I am able to patch it tomorrow morning (for me in around 8 hours) while I am on the train.
|
This PR updates Alpine to version 3.19 which includes fixes for 10 vulnerabilities (8 Medium-level vulnerabilities and 2 Unknown ones).
I will send @dyc3 an email with a screenshot of affected packages and CVE numbers.
Please look in your spam folder too, google flags some of my mails...