docker image vulnerabilities at arcdata extension

[v-vegujjula]

Describe the bug

We’ve observed that our ACR Docker images are under compliance review and need to be cleaned and rebuilt. Previously, we were using the base image mcr.microsoft.com/cbl-mariner/base/python:3.9, but we’ve now noted that this image will reach End of Life (EOL) on July 31, 2025.

As part of the remediation, I’ve updated the base image to mcr.microsoft.com/azurelinux/base/python:3.12. However, after rebuilding, vulnerabilities are still being reported.

Please refer the latest docker image with tag "vfix" and the issue for Jinja2 at arcdata extension.

Ref: Vulnerability Management
Exploring Security for Kubernetes Connect Service
https://mcr.microsoft.com/en-us/artifact/mar/azurelinux/base/python/about

Related command

We are building docker images with ADO pipeline.

Sample docker file
FROM mcr.microsoft.com/azurelinux/base/python:3.12
RUN tdnf makecache && tdnf update -y && tdnf install -y tar && tdnf install -y gawk && tdnf install -y util-linux
RUN tdnf install gnupg ca-certificates curl wget jq -y
RUN tdnf install azure-cli -y
RUN /usr/bin/curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/latest.txt)/bin/linux/amd64/kubectl
&& chmod +x ./kubectl
&& mv ./kubectl /usr/local/bin/kubectl

COPY ./ds_connect_core/requirements.txt ./
RUN --mount=type=secret,id=ado_pat,target=/run/secrets/ado_pat
token=$(cat /run/secrets/ado_pat) &&
index_url="https://ArcValidationPackages:$token@pkgs.dev.azure.com/ArcValidationProgram/ArcValidationProgram/_packaging/ArcValidationPackages/pypi/simple/" &&
mkdir -p ~/.config/pip &&
echo "[global]" > ~/.config/pip/pip.conf &&
echo "index-url = $index_url" >> ~/.config/pip/pip.conf &&
echo "extra-index-url = $index_url" >> ~/.config/pip/pip.conf &&
echo "trusted-host = pkgs.dev.azure.com" >> ~/.config/pip/pip.conf &&
cat ~/.config/pip/pip.conf &&
pip install --upgrade -r requirements.txt

#RUN az upgrade --yes
RUN az extension add --upgrade --name connectedk8s --yes --debug
RUN az extension add --upgrade --name k8s-configuration --yes --debug
RUN az extension add --upgrade --name k8s-extension --yes --debug
RUN az extension add --upgrade --name customlocation --yes --debug
RUN az extension add --upgrade --name arcdata --yes --debug
RUN tdnf update -y
ARG SONOBUOY_VERSION
RUN curl -L https://github.com/vmware-tanzu/sonobuoy/releases/download/v${SONOBUOY_VERSION}/sonobuoy_${SONOBUOY_VERSION}_linux_amd64.tar.gz --output /bin/sonobuoy.tar.gz
RUN ["tar", "-xzf", "/bin/sonobuoy.tar.gz", "-C", "/bin/"]
COPY ["./ds_connect_core/arc_ds_connect_conformance.sh", "./ds_connect_core/ds_pre_cleanup.sh", "./ds_connect_core/ds_setup_failure_handler.py", "./"]
COPY ["./ds_connect_core/pytest.ini", "./ds_connect_core/conftest.py", "./common", "/conformancetests/"]
COPY ["./ds_connect_core/pytest.ini", "./ds_connect_core/conftest.py", "./common", "/conformancetests-indirect/"]

Ds direct tests

COPY ["./ds_connect_core/ds_connect_constants.py", "./ds_connect_core/test_check_namespace_existence.py", "./ds_connect_core/test_check_pod_existence.py", "./ds_connect_core/test_check_pv_existence.py", "./ds_connect_core/test_ds_direct_cleanup.py", "./ds_connect_core/test_check_kubernetes_extension_arm.py", "/ds_connect_core/test_check_datacontroller_arm.py", "./ds_connect_core/test_check_customlocation_arm.py", "./ds_connect_core/test_check_connected_cluster_arm.py", "./ds_connect_core/test_check_azure_arc_namespace_existence.py", "./ds_connect_core/test_data_controller_ready.py", "./ds_connect_core/test_create_sql_mi.py", "/conformancetests/"]

To do will add these below tests once postgres sql is ready from az cli

#COPY ./ds_connect_core/test_create_postgressql.py /conformancetests/
#COPY ./ds_connect_core/test_scale_out_postgressql.py /conformancetests/

DS indirect tests

COPY ["./ds_core/test_check_namespace_existence.py", "./ds_core/test_check_pod_existence.py", "./ds_core/test_check_pv_existence.py", "./ds_core/test_create_sql_mi.py", "./ds_core/test_data_controller_ready.py", "./ds_core/test_create_postgressql.py", "./ds_core/test_scale_out_postgressql.py", "./ds_core/test_ds_indirect_cleanup.py", "/conformancetests-indirect/"]

RUN ["chmod", "+x", "ds_pre_cleanup.sh"]
RUN ["chmod", "+x", "arc_ds_connect_conformance.sh"]
RUN sed -i -e 's/\r$//' arc_ds_connect_conformance.sh
RUN sed -i -e 's/\r$//' ds_pre_cleanup.sh
RUN rm -rf ~/.config/pip/pip.conf
ENTRYPOINT ["/arc_ds_connect_conformance.sh"]

Errors

vulnerability flags from service 360

https://vnext.s360.msftcloudes.com/blades/security?blade=AssignedTo:All~KPI:527fb616-07aa-8198-6419-50d04ef1c2f3~SLA:2~Forums:All~Program:68556099-a3e2-472e-8da0-e1d1b000eda4;65a010a5-1e3d-4777-bb89-f149470a507d~waves:All~Tab:Summary~_loc:Security&peopleBasedNodes=jianyan_team;nizlati_team&global=4:ca2412ef-15d7-4f2e-b215-edcbe7ee940d

https://dataexplorer.azure.com/dashboards/48834d42-391b-479d-a0fd-b748d939626b?p-_Filter_StartDt=365days&p-_Filter_EndDt=now&p-_Filter_Division=all&p-_Filter_Organization=all&p-_Filter_ServiceGroup=all&p-_Filter_TeamGroup=all&p-_Filter_Service=all&p-_Filter_RemediationOwner=v-ca2412ef-15d7-4f2e-b215-edcbe7ee940d&p-_Filter_Actions=v-ReplaceVulnerableRegistryReference&p-_Filter_ScanToolNames=v-ContainerImageScan&p-_Filter_AssetType=all&p-_Filter_VulnerabilityId=all&p-_Filter_SLA=v-Past+SLA&p-_Filter_CustomGroupingLink=v-&p-_Filter_SubscriptionId=all&p-_Filter_Environment=all&p-_Filter_Cloud=all&p-_Filter_ResourceGroup=all&p-_Filter_Registry=all&p-_Filter_Image=all&p-_Filter_Digest=all&p-_Filter_ExcludeAction=v-None#692cdf78-4515-49cf-be27-09305d28ad8d

Issue script & Debug output

Please refer the image and document.

Expected behavior

vulnerability free.

Environment Summary

root [ / ]# az -v
azure-cli 2.75.0

core 2.75.0
telemetry 1.1.0

Extensions:
arcdata 1.5.24

Dependencies:
msal 1.33.0b1
azure-mgmt-resource 23.3.0

Python location '/usr/bin/python3.12'
Config directory '/root/.azure'
Extensions directory '/root/.azure/cliextensions'

Python (Linux) 3.12.9 (main, Jun 12 2025, 19:38:44) [GCC 13.2.0]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

Please guide and suggest us.

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @akashkeshari.

[v-vegujjula]

@yonzhan
May I know to which team its routed and where can I see the further updates.