updates to Dockerfile - #739
Open
wdower wants to merge 2 commits into
Open
Conversation
…tting a missing-user error, combine COPY statements to avoid permissions errors when creating subdirectories in RUN steps, pinning base image version with hash Signed-off-by: Will <will@dower.dev>
… files Signed-off-by: Will <will@dower.dev>
|
wdower
added a commit
that referenced
this pull request
Jul 31, 2026
* fix(security): remediate shipped-image gem CVEs + ECI build fixes Clears the 25 HIGH/CRITICAL gemspec findings from #743 (local rebuild + Trivy: 0 gemspec findings; total 47->17, remainder are out-of-scope UBI9 OS packages). Gems (bundle update within existing constraints, no majors; bundler-audit clean): concurrent-ruby 1.3.8, faraday 1.10.6, oj 3.17.4, websocket-driver 0.8.2, crass 1.0.7, json 2.21.1, loofah 2.25.2, msgpack 1.8.3, rails-html-sanitizer 1.7.1. faraday pinned '~> 1.10', '>= 1.10.6' (CVE-2026-54297) since bundle update mis-resolves the transitive gem down to 1.3.1. Toolchain: Ruby 3.4.9->3.4.10 (patched default gems erb 4.0.4.1 / net-imap 0.5.15, CVE-2026-41316 + net-imap advisories), Node 24.14.0->24.18.0, yarn upgrade within package.json ranges. Build (incorporates #739): base image digest-pinned, tar --no-same-owner, combined COPY -- required to build under Docker Enhanced Container Isolation. Signed-off-by: Will <will@dower.dev> * chore: remove giant comment from Gemfile Signed-off-by: Will <will@dower.dev> * fix(ci): sync Ruby/Node version pins to 3.4.10 for CVE patch The gem-CVE remediation bumped Ruby to 3.4.10 in Gemfile/Gemfile.lock/ Dockerfile but left CI-facing pins at 3.4.9: - .ruby-version / .tool-versions drove setup-ruby to install 3.4.9, aborting bundle install (Gemfile specifies 3.4.10). - docker-bake.hcl passed RUBY_VERSION=3.4.9 as a build-arg against the Dockerfile's 3.4.10 SHA256, failing the tarball checksum. Sync all pins to 3.4.10 (and bake node default to 24.18.0 to match the Dockerfile ARG). Signed-off-by: Will <will@dower.dev> * ci: build Ruby from source for lint/backend (ruby-builder lacks 3.4.10) ruby/setup-ruby installs prebuilt binaries from ruby-builder, which has no 3.4.10 build yet (source tarball exists; only compilation works). The docker job already builds Ruby from source, but lint/backend fail at setup with 'Unknown version 3.4.10 for ruby on ubuntu-24.04'. Add a composite action that compiles the pinned Ruby from source (mirroring the Dockerfile: source fetch + SHA256 verify + configure/make /install), caching both the compiled Ruby and the gem bundle. Wire lint and backend to it so CI tests on the same 3.4.10 the image ships. Temporary: revert to ruby/setup-ruby once ruby-builder publishes a 3.4.10 binary. Timeouts bumped to cover a one-time cold compile. Signed-off-by: Will <will@dower.dev> * fix(deps): bump bootsnap to 1.24.6 for Ruby 3.4.10 boot under coverage bootsnap 1.18.6 mis-detects Ruby bug #22023 on 3.4.x patch releases, so RubyVM::InstructionSequence#to_binary raises 'should not compile with coverage' at boot when SimpleCov is active, crashing every backend CI shard on Ruby 3.4.10. 1.24.6 fixes the detection and applies the workaround. Lockfile-only (Gemfile already allows >= 1.4.2). Signed-off-by: Will <will@dower.dev> * fix(security): bump Rails to 8.0.5.1 for CVE-2026-66066 bundler-audit flags CVE-2026-66066 (arbitrary file read + RCE in Active Storage variant processing) against activestorage 8.0.5. Rails 8.0.5.1 is the fixed release. Lockfile-only (Gemfile already allows ~> 8.0.0). Signed-off-by: Will <will@dower.dev> * harden: enforce HTTPS on build-time curl downloads (Sonar S6506) Add --proto '=https' --proto-redir '=https' to every build-time curl so it refuses any non-HTTPS hop, including redirects, closing the transport downgrade vector SonarCloud S6506 flags (downloads are already SHA256- verified). Covers the Ruby, jemalloc, and Node fetches in the Dockerfile and the Ruby fetch in the CI source-build action. Signed-off-by: Will <will@dower.dev> --------- Signed-off-by: Will <will@dower.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recently switched to developing on a system with Docker Enhanced Container Isolation and noted Vulcan can't build as usual. Needed to update the Dockerfile to account for ECI.
I can now locally build the image but we should probably check it still builds on other systems.