Skip to content

Commit 8ac2038

Browse files
suyadav1suyadav1
authored
Mariner 3 upgrade (#1439)
* Mariner 3 upgrade * updated packages for Telegraf * Fix repo path * nit * Mariner 3 upgrade * updated packages for Telegraf * Fix repo path * nit * revert fluentd version * nit * Mariner 3 upgrade * updated packages for Telegraf * Fix repo path * nit * revert fluentd version * nit
1 parent e89e042 commit 8ac2038

File tree

5 files changed

+198
-236
lines changed

5 files changed

+198
-236
lines changed

‎.trivyignore‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +0,0 @@
1-
#telegraf MEDIUM
2-
CVE-2024-35255
3-
CVE-2024-28110
4-
CVE-2024-24557
5-
CVE-2024-29018
6-
CVE-2024-27304
7-
GHSA-7jwh-3vrq-q3m8
8-
CVE-2024-27289
9-
CVE-2024-27304
10-
CVE-2023-45288
11-
CVE-2024-24786

‎kubernetes/linux/Dockerfile.multiarch‎

Lines changed: 174 additions & 178 deletions
Original file line numberDiff line numberDiff line change
@@ -1,178 +1,174 @@
1-
# Default base images. If you update them don't forgot to update variables in our build pipelines. Default values can be found in internal wiki. External can use ubuntu 18.04 and golang 1.18.3
2-
ARG GOLANG_BASE_IMAGE=
3-
ARG MARINER_BASE_IMAGE=mcr.microsoft.com/cbl-mariner/base/core:2.0
4-
ARG MARINER_DISTROLESS_IMAGE=mcr.microsoft.com/cbl-mariner/distroless/base:2.0
5-
6-
FROM --platform=$BUILDPLATFORM ${GOLANG_BASE_IMAGE} AS golang-builder
7-
ARG TARGETOS TARGETARCH
8-
RUN /usr/bin/apt-get update && /usr/bin/apt-get install git g++ make pkg-config libssl-dev libpam0g-dev rpm librpm-dev uuid-dev libkrb5-dev python-is-python3 sudo gcc-aarch64-linux-gnu -y
9-
10-
COPY build /src/build
11-
COPY source /src/source
12-
RUN cd /src/build/linux && make arch=${TARGETARCH}
13-
14-
15-
FROM ${MARINER_BASE_IMAGE} AS builder
16-
ARG TARGETOS TARGETARCH
17-
LABEL maintainer="[email protected]"
18-
LABEL vendor=Microsoft\ Corp \
19-
com.microsoft.product="Azure Monitor for containers"
20-
ENV tmpdir /opt
21-
22-
RUN tdnf clean all
23-
RUN tdnf repolist --refresh
24-
RUN tdnf -y update
25-
RUN tdnf install -y \
26-
build-essential \
27-
wget \
28-
curl \
29-
sudo \
30-
net-tools \
31-
cronie \
32-
rsyslog \
33-
dmidecode \
34-
gnupg \
35-
make \
36-
logrotate \
37-
busybox \
38-
gawk \
39-
tar \
40-
ca-certificates \
41-
&& rm -rf /var/lib/apt/lists/*
42-
RUN mkdir /busybin && busybox --install /busybin
43-
44-
COPY --from=golang-builder /src/kubernetes/linux/Linux_ULINUX_1.0_*_64_Release/docker-cimprov-*.*.*-*.*.sh $tmpdir/
45-
COPY kubernetes/linux/setup.sh kubernetes/linux/main.sh kubernetes/linux/defaultpromenvvariables kubernetes/linux/defaultpromenvvariables-rs kubernetes/linux/defaultpromenvvariables-sidecar kubernetes/linux/mdsd.xml kubernetes/linux/envmdsd kubernetes/linux/logrotate.conf $tmpdir/
46-
47-
COPY kubernetes/linux/mariner-official-cloud-native-arm64.repo /tmp/mariner-official-cloud-native-arm64.repo
48-
COPY kubernetes/linux/mariner-official-cloud-native-amd64.repo /tmp/mariner-official-cloud-native-amd64.repo
49-
RUN if [ "${TARGETARCH}" == "arm64" ]; then \
50-
cp /tmp/mariner-official-cloud-native-arm64.repo /etc/yum.repos.d/; \
51-
else \
52-
cp /tmp/mariner-official-cloud-native-amd64.repo /etc/yum.repos.d/; \
53-
fi
54-
55-
WORKDIR ${tmpdir}
56-
57-
RUN chmod 775 $tmpdir/*.sh; sync; $tmpdir/setup.sh ${TARGETARCH}
58-
59-
FROM ${MARINER_DISTROLESS_IMAGE} AS distroless_image
60-
LABEL maintainer="[email protected]"
61-
LABEL vendor=Microsoft\ Corp \
62-
com.microsoft.product="Azure Monitor for containers"
63-
ENV tmpdir /opt
64-
ENV PATH="/busybin:${PATH}"
65-
ENV APPLICATIONINSIGHTS_AUTH NzAwZGM5OGYtYTdhZC00NThkLWI5NWMtMjA3ZjM3NmM3YmRi
66-
ENV MALLOC_ARENA_MAX 2
67-
ENV HOST_MOUNT_PREFIX /hostfs
68-
ENV HOST_PROC /hostfs/proc
69-
ENV HOST_SYS /hostfs/sys
70-
ENV HOST_ETC /hostfs/etc
71-
ENV HOST_VAR /hostfs/var
72-
ENV AZMON_COLLECT_ENV False
73-
ENV KUBE_CLIENT_BACKOFF_BASE 1
74-
ENV KUBE_CLIENT_BACKOFF_DURATION 0
75-
ENV RUBY_GC_HEAP_OLDOBJECT_LIMIT_FACTOR 0.9
76-
77-
# default value will be overwritten by pipeline
78-
ARG IMAGE_TAG=3.1.27
79-
ENV AGENT_VERSION ${IMAGE_TAG}
80-
81-
WORKDIR ${tmpdir}
82-
83-
# files
84-
COPY --from=builder /opt /opt
85-
COPY --from=builder /etc /etc
86-
COPY --from=builder /busybin /busybin
87-
COPY --from=builder /var/opt/microsoft /var/opt/microsoft
88-
COPY --from=builder /var/lib/logrotate /var/lib/logrotate
89-
COPY --from=builder /var/spool/cron /var/spool/cron
90-
91-
# executables
92-
COPY --from=builder /usr/bin/sh /usr/bin/sh
93-
COPY --from=builder /usr/bin/bash /usr/bin/bash
94-
COPY --from=builder /usr/bin/ruby /usr/bin/ruby
95-
COPY --from=builder /usr/lib/ruby /usr/lib/ruby
96-
COPY --from=builder /usr/bin/inotifywait /usr/bin/inotifywait
97-
COPY --from=builder /usr/sbin/busybox /usr/sbin/busybox
98-
COPY --from=builder /usr/bin/fluent-bit /usr/bin/fluent-bit
99-
COPY --from=builder /opt/telegraf /opt/telegraf
100-
COPY --from=builder /usr/sbin/crond /usr/sbin/crond
101-
COPY --from=builder /usr/sbin/mdsd /usr/sbin/mdsd
102-
COPY --from=builder /usr/sbin/logrotate /usr/sbin/logrotate
103-
COPY --from=builder /usr/sbin/setcap /usr/sbin/setcap
104-
COPY --from=builder /usr/bin/curl /usr/bin/curl
105-
COPY --from=builder /usr/bin/jq /usr/bin/jq
106-
COPY --from=builder /usr/bin/base64 /usr/bin/base64
107-
COPY --from=builder /usr/bin/fluentd /usr/bin/fluentd
108-
COPY --from=builder /usr/bin/update-ca-trust /usr/bin/update-ca-trust
109-
COPY --from=builder /usr/bin/p11-kit /usr/bin/p11-kit
110-
COPY --from=builder /usr/bin/trust /usr/bin/trust
111-
COPY --from=builder /usr/share/pki/ca-trust-source /usr/share/pki/ca-trust-source
112-
COPY --from=builder /usr/share/p11-kit/ /usr/share/p11-kit/
113-
114-
# bash dependencies
115-
COPY --from=builder /lib/libreadline.so.8 /lib/
116-
COPY --from=builder /usr/lib/libncursesw.so.6 /usr/lib/libtinfo.so.6 /usr/lib/
117-
# inotifywait dependencies
118-
COPY --from=builder /lib/libinotifytools.so.0 /lib/
119-
COPY --from=builder /lib/libc.so.6 /lib/
120-
# crond dependencies
121-
COPY --from=builder /lib/libselinux.so.1 /lib/libpam.so.0 /lib/libc.so.6 /lib/libpcre.so.1 /lib/libaudit.so.1 /lib/libcap-ng.so.0/ /lib/
122-
# ruby dependencies
123-
COPY --from=builder /usr/lib/libruby.so.3.1 /usr/lib/libz.so.1 /usr/lib/libgmp.so.10 /usr/lib/libcrypt.so.1 /usr/lib/libm.so.6 /usr/lib/libc.so.6 /usr/lib/
124-
# fluent-bit dependencies
125-
# libssl.so.1.1 & libcrypto.so.1.1 are already available with openssl in distroless and copying them over causes FIPS HMAC verification failures
126-
COPY --from=builder /lib/libyaml-0.so.2 /lib/libsystemd.so.0 /lib/libm.so.6 /lib/libgcc_s.so.1 /lib/libc.so.6 /lib/liblzma.so.5 /lib/liblz4.so.1 /lib/libcap.so.2 /lib/libgcrypt.so.20 /lib/libgpg-error.so.0 /lib/libsasl2.so.3 /lib/
127-
# telegraf dependencies
128-
COPY --from=builder /lib/libresolv.so.2 /lib/libc.so.6 /lib/
129-
# mdsd dependencies
130-
COPY --from=builder /usr/lib/libdl.so.2 /usr/lib/librt.so.1 /usr/lib/libpthread.so.0 /usr/lib/libm.so.6 /usr/lib/libstdc++.so.6 /usr/lib/libgcc_s.so.1 /usr/lib/
131-
COPY --from=builder /opt/microsoft/azure-mdsd/lib/libtcmalloc_minimal.so.4 /opt/microsoft/azure-mdsd/lib/
132-
COPY --from=builder /opt/microsoft/azure-mdsd/lib/libsymcrypt.so.103 /opt/microsoft/azure-mdsd/lib/
133-
# logrotate dependencies
134-
COPY --from=builder /lib/libselinux.so.1 /lib/libpopt.so.0 /lib/libc.so.6 /lib/libpcre.so.1 /lib/
135-
# curl dependencies
136-
# libssl.so.1.1 & libcrypto.so.1.1 are already available with openssl in distroless and copying them over causes FIPS HMAC verification failures
137-
COPY --from=builder /lib/libcurl.so.4 /lib/libz.so.1 /lib/libc.so.6 /lib/libnghttp2.so.14 /lib/libssh2.so.1 /lib/libgssapi_krb5.so.2 /lib/libzstd.so.1 /lib/
138-
COPY --from=builder /usr/lib/libkrb5.so.3 /usr/lib/libk5crypto.so.3 /usr/lib/libcom_err.so.2 /usr/lib/libkrb5support.so.0 /usr/lib/libresolv.so.2 /usr/lib/
139-
# jq dependencies
140-
COPY --from=builder /lib/libjq.so.1 /lib/libc.so.6 /lib/libm.so.6 /lib/libonig.so.5 /lib/
141-
# update-ca-trust dependencies
142-
COPY --from=builder /lib/libp11-kit.so.0 /lib/libffi.so.8 /lib/libtasn1.so.6 /lib/
143-
COPY --from=builder /lib/pkcs11/p11-kit-trust.so /lib/pkcs11/
144-
RUN ln -s /lib/pkcs11/p11-kit-trust.so /lib/libnssckbi.so
145-
RUN ln -s /lib/libnssckbi.so /lib/p11-kit-trust.so
146-
147-
# Do vulnerability scan in a seperate stage to avoid adding layer
148-
FROM distroless_image AS vulnscan
149-
COPY .trivyignore .trivyignore
150-
RUN ["/bin/bash", "-c", "curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.39.0"]
151-
152-
# Set up primary and secondary repository URLs
153-
ENV PRIMARY_TRIVY_DB_REPOSITORY="ghcr.io/aquasecurity/trivy-db"
154-
ENV SECONDARY_TRIVY_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-db"
155-
156-
# Download Trivy main database with a fallback mechanism
157-
RUN export TRIVY_DB_REPOSITORY=$PRIMARY_TRIVY_DB_REPOSITORY && \
158-
trivy image --download-db-only || \
159-
(echo "Primary TRIVY_DB_REPOSITORY failed, trying secondary." && \
160-
export TRIVY_DB_REPOSITORY=$SECONDARY_TRIVY_DB_REPOSITORY && \
161-
trivy image --download-db-only) || \
162-
(echo "Both TRIVY_DB_REPOSITORY sources failed." && exit 1)
163-
164-
# Perform Trivy rootfs scan (only OS vulnerabilities, no Java scanning)
165-
RUN ["/bin/bash", "-c", "trivy rootfs --ignore-unfixed --no-progress --severity HIGH,CRITICAL,MEDIUM --vuln-type os --scanners vuln --skip-files \"/usr/local/bin/trivy\" /"]
166-
RUN ["/bin/bash", "-c", "trivy rootfs --ignore-unfixed --no-progress --severity HIGH,CRITICAL,MEDIUM --vuln-type os --scanners vuln /usr/lib"]
167-
RUN ["/bin/bash", "-c", "trivy rootfs --exit-code 1 --ignore-unfixed --no-progress --severity HIGH,CRITICAL,MEDIUM --vuln-type os --scanners vuln --skip-files \"/usr/local/bin/trivy\" / > /dev/null 2>&1 && trivy rootfs --exit-code 1 --ignore-unfixed --no-progress --severity HIGH,CRITICAL,MEDIUM --vuln-type os --scanners vuln /usr/lib > /dev/null 2>&1"]
168-
169-
# Revert to base layer before vulnscan
170-
FROM distroless_image AS ContainerInsights
171-
# force the trivy stage to run
172-
# docker buildx (BUILDKIT) does not build stages which do not affect the final stage
173-
# by copying over a file we create a dependency
174-
# see: https://github.com/docker/build-push-action/issues/377
175-
COPY --from=vulnscan /usr/local/bin/trivy /usr/local/bin/trivy
176-
RUN ["/bin/bash", "-c", "rm -rf /usr/local/bin/trivy"]
177-
178-
CMD [ "/opt/main.sh" ]
1+
# Default base images. If you update them don't forgot to update variables in our build pipelines. Default values can be found in internal wiki. External can use ubuntu 18.04 and golang 1.18.3
2+
ARG GOLANG_BASE_IMAGE=
3+
ARG MARINER_BASE_IMAGE=mcr.microsoft.com/azurelinux/base/core:3.0
4+
ARG MARINER_DISTROLESS_IMAGE=mcr.microsoft.com/azurelinux/distroless/base:3.0
5+
6+
FROM --platform=$BUILDPLATFORM ${GOLANG_BASE_IMAGE} AS golang-builder
7+
ARG TARGETOS TARGETARCH
8+
RUN /usr/bin/apt-get update && /usr/bin/apt-get install git g++ make pkg-config libssl-dev libpam0g-dev rpm librpm-dev uuid-dev libkrb5-dev python-is-python3 sudo gcc-aarch64-linux-gnu -y
9+
10+
COPY build /src/build
11+
COPY source /src/source
12+
RUN cd /src/build/linux && make arch=${TARGETARCH}
13+
14+
15+
FROM ${MARINER_BASE_IMAGE} AS builder
16+
ARG TARGETOS TARGETARCH
17+
LABEL maintainer="[email protected]"
18+
LABEL vendor=Microsoft\ Corp \
19+
com.microsoft.product="Azure Monitor for containers"
20+
ENV tmpdir /opt
21+
22+
RUN tdnf clean all
23+
RUN tdnf repolist --refresh
24+
RUN tdnf -y update
25+
RUN tdnf install -y \
26+
build-essential \
27+
wget \
28+
curl \
29+
sudo \
30+
net-tools \
31+
cronie \
32+
rsyslog \
33+
dmidecode \
34+
gnupg \
35+
make \
36+
logrotate \
37+
busybox \
38+
gawk \
39+
tar \
40+
ca-certificates \
41+
&& rm -rf /var/lib/apt/lists/*
42+
RUN mkdir /busybin && busybox --install /busybin
43+
44+
COPY --from=golang-builder /src/kubernetes/linux/Linux_ULINUX_1.0_*_64_Release/docker-cimprov-*.*.*-*.*.sh $tmpdir/
45+
COPY kubernetes/linux/setup.sh kubernetes/linux/main.sh kubernetes/linux/defaultpromenvvariables kubernetes/linux/defaultpromenvvariables-rs kubernetes/linux/defaultpromenvvariables-sidecar kubernetes/linux/mdsd.xml kubernetes/linux/envmdsd kubernetes/linux/logrotate.conf $tmpdir/
46+
47+
COPY kubernetes/linux/azurelinux-official-cloud-native-arm64.repo /tmp/azurelinux-official-cloud-native-arm64.repo
48+
COPY kubernetes/linux/azurelinux-official-cloud-native-amd64.repo /tmp/azurelinux-official-cloud-native-amd64.repo
49+
RUN if [ "${TARGETARCH}" == "arm64" ]; then \
50+
cp /tmp/azurelinux-official-cloud-native-arm64.repo /etc/yum.repos.d/; \
51+
else \
52+
cp /tmp/azurelinux-official-cloud-native-amd64.repo /etc/yum.repos.d/; \
53+
fi
54+
55+
WORKDIR ${tmpdir}
56+
57+
RUN chmod 775 $tmpdir/*.sh; sync; $tmpdir/setup.sh ${TARGETARCH}
58+
59+
FROM ${MARINER_DISTROLESS_IMAGE} AS distroless_image
60+
LABEL maintainer="[email protected]"
61+
LABEL vendor=Microsoft\ Corp \
62+
com.microsoft.product="Azure Monitor for containers"
63+
ENV tmpdir /opt
64+
ENV PATH="/busybin:${PATH}"
65+
ENV APPLICATIONINSIGHTS_AUTH NzAwZGM5OGYtYTdhZC00NThkLWI5NWMtMjA3ZjM3NmM3YmRi
66+
ENV MALLOC_ARENA_MAX 2
67+
ENV HOST_MOUNT_PREFIX /hostfs
68+
ENV HOST_PROC /hostfs/proc
69+
ENV HOST_SYS /hostfs/sys
70+
ENV HOST_ETC /hostfs/etc
71+
ENV HOST_VAR /hostfs/var
72+
ENV AZMON_COLLECT_ENV False
73+
ENV KUBE_CLIENT_BACKOFF_BASE 1
74+
ENV KUBE_CLIENT_BACKOFF_DURATION 0
75+
ENV RUBY_GC_HEAP_OLDOBJECT_LIMIT_FACTOR 1.0
76+
77+
# default value will be overwritten by pipeline
78+
ARG IMAGE_TAG=3.1.27
79+
ENV AGENT_VERSION ${IMAGE_TAG}
80+
81+
WORKDIR ${tmpdir}
82+
83+
# files
84+
COPY --from=builder /opt /opt
85+
COPY --from=builder /etc /etc
86+
COPY --from=builder /busybin /busybin
87+
COPY --from=builder /var/opt/microsoft /var/opt/microsoft
88+
COPY --from=builder /var/lib/logrotate /var/lib/logrotate
89+
COPY --from=builder /var/spool/cron /var/spool/cron
90+
91+
# executables
92+
COPY --from=builder /usr/bin/sh /usr/bin/sh
93+
COPY --from=builder /usr/bin/bash /usr/bin/bash
94+
COPY --from=builder /usr/bin/ruby /usr/bin/ruby
95+
COPY --from=builder /usr/lib/ruby /usr/lib/ruby
96+
COPY --from=builder /usr/bin/inotifywait /usr/bin/inotifywait
97+
COPY --from=builder /usr/sbin/busybox /usr/sbin/busybox
98+
COPY --from=builder /usr/bin/fluent-bit /usr/bin/fluent-bit
99+
COPY --from=builder /opt/telegraf /opt/telegraf
100+
COPY --from=builder /usr/sbin/crond /usr/sbin/crond
101+
COPY --from=builder /usr/sbin/mdsd /usr/sbin/mdsd
102+
COPY --from=builder /usr/sbin/logrotate /usr/sbin/logrotate
103+
COPY --from=builder /usr/sbin/setcap /usr/sbin/setcap
104+
COPY --from=builder /usr/bin/curl /usr/bin/curl
105+
COPY --from=builder /usr/bin/jq /usr/bin/jq
106+
COPY --from=builder /usr/bin/base64 /usr/bin/base64
107+
COPY --from=builder /usr/bin/fluentd /usr/bin/fluentd
108+
COPY --from=builder /usr/bin/update-ca-trust /usr/bin/update-ca-trust
109+
COPY --from=builder /usr/bin/p11-kit /usr/bin/p11-kit
110+
COPY --from=builder /usr/bin/trust /usr/bin/trust
111+
COPY --from=builder /usr/share/pki/ca-trust-source /usr/share/pki/ca-trust-source
112+
COPY --from=builder /usr/share/p11-kit/ /usr/share/p11-kit/
113+
114+
# bash dependencies
115+
COPY --from=builder /usr/lib/libreadline.so.8 /usr/lib/libc.so.6 /usr/lib/libncursesw.so.6 /usr/lib/libtinfo.so.6 /usr/lib/
116+
# inotifywait dependencies
117+
COPY --from=builder /usr/lib/libinotifytools.so.0 /usr/lib/libstdc++.so.6 /usr/lib/libgcc_s.so.1 /usr/lib/libc.so.6 /usr/lib/libm.so.6 /usr/lib/
118+
# crond dependencies
119+
COPY --from=builder /usr/lib/libselinux.so.1 /usr/lib/libpam.so.0 /usr/lib/libc.so.6 /usr/lib/
120+
# ruby dependencies
121+
COPY --from=builder /usr/lib/libruby.so.3.3 /usr/lib/libc.so.6 /usr/lib/libz.so.1 /usr/lib/libgmp.so.10 /usr/lib/libcrypt.so.1 /usr/lib/libm.so.6 /usr/lib/
122+
# fluent-bit dependencies
123+
# libssl.so.3 & libcrypto.so.3 are already available with openssl in distroless and copying them over causes FIPS HMAC verification failures
124+
COPY --from=builder /usr/lib/libluajit-5.1.so.2 /usr/lib/libyaml-0.so.2 /usr/lib/libsystemd.so.0 /usr/lib/libcurl.so.4 /usr/lib/libz.so.1 /usr/lib/libzstd.so.1 /usr/lib/libsasl2.so.3 /usr/lib/libm.so.6 /usr/lib/libgcc_s.so.1 /usr/lib/libc.so.6 /usr/lib/libcap.so.2 /usr/lib/liblz4.so.1 /usr/lib/liblzma.so.5 /usr/lib/libnghttp2.so.14 /usr/lib/libssh2.so.1 /usr/lib/libgssapi_krb5.so.2 /usr/lib/libresolv.so.2 /usr/lib/libkrb5.so.3 /usr/lib/libk5crypto.so.3 /usr/lib/libcom_err.so.2 /usr/lib/libkrb5support.so.0 /usr/lib/
125+
# telegraf dependencies
126+
COPY --from=builder /usr/lib/libresolv.so.2 /usr/lib/libc.so.6 /usr/lib/
127+
# mdsd dependencies
128+
COPY --from=builder /usr/sbin/../lib/libpthread.so.0 /usr/sbin/../lib/libdl.so.2 /usr/sbin/../lib/libsymcrypt.so.103 /usr/sbin/../lib/librt.so.1 /usr/sbin/../lib/libm.so.6 /usr/sbin/../lib/libc.so.6 /usr/sbin/../lib/libstdc++.so.6 /usr/sbin/../lib/libgcc_s.so.1 /usr/sbin/../lib/
129+
COPY --from=builder /opt/microsoft/azure-mdsd/lib/libtcmalloc_minimal.so.4 /opt/microsoft/azure-mdsd/lib/
130+
# logrotate dependencies
131+
COPY --from=builder /usr/lib/libpopt.so.0 /usr/lib/libc.so.6 /usr/lib/
132+
# curl dependencies
133+
# libssl.so.1.1 & libcrypto.so.1.1 are already available with openssl in distroless and copying them over causes FIPS HMAC verification failures
134+
COPY --from=builder /usr/lib/libcurl.so.4 /usr/lib/libz.so.1 /usr/lib/libc.so.6 /usr/lib/libnghttp2.so.14 /usr/lib/libssh2.so.1 /usr/lib/libgssapi_krb5.so.2 /usr/lib/libzstd.so.1 /usr/lib/libkrb5.so.3 /usr/lib/libk5crypto.so.3 /usr/lib/libcom_err.so.2 /usr/lib/libkrb5support.so.0 /usr/lib/libresolv.so.2 /usr/lib/
135+
# jq dependencies
136+
COPY --from=builder /usr/lib/libjq.so.1 /usr/lib/libc.so.6 /usr/lib/libm.so.6 /usr/lib/libonig.so.5 /usr/lib/
137+
# update-ca-trust dependencies
138+
COPY --from=builder /lib/libp11-kit.so.0 /lib/libffi.so.8 /lib/libtasn1.so.6 /lib/
139+
COPY --from=builder /lib/pkcs11/p11-kit-trust.so /lib/pkcs11/
140+
RUN ln -s /lib/pkcs11/p11-kit-trust.so /lib/libnssckbi.so
141+
RUN ln -s /lib/libnssckbi.so /lib/p11-kit-trust.so
142+
143+
# Do vulnerability scan in a seperate stage to avoid adding layer
144+
FROM distroless_image AS vulnscan
145+
COPY .trivyignore .trivyignore
146+
RUN ["/bin/bash", "-c", "curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.39.0"]
147+
148+
# Set up primary and secondary repository URLs
149+
ENV PRIMARY_TRIVY_DB_REPOSITORY="ghcr.io/aquasecurity/trivy-db"
150+
ENV SECONDARY_TRIVY_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-db"
151+
152+
# Download Trivy main database with a fallback mechanism
153+
RUN export TRIVY_DB_REPOSITORY=$PRIMARY_TRIVY_DB_REPOSITORY && \
154+
trivy image --download-db-only || \
155+
(echo "Primary TRIVY_DB_REPOSITORY failed, trying secondary." && \
156+
export TRIVY_DB_REPOSITORY=$SECONDARY_TRIVY_DB_REPOSITORY && \
157+
trivy image --download-db-only) || \
158+
(echo "Both TRIVY_DB_REPOSITORY sources failed." && exit 1)
159+
160+
# Perform Trivy rootfs scan (only OS vulnerabilities, no Java scanning)
161+
RUN ["/bin/bash", "-c", "trivy rootfs --ignore-unfixed --no-progress --severity HIGH,CRITICAL,MEDIUM --vuln-type os --scanners vuln --skip-files \"/usr/local/bin/trivy\" /"]
162+
RUN ["/bin/bash", "-c", "trivy rootfs --ignore-unfixed --no-progress --severity HIGH,CRITICAL,MEDIUM --vuln-type os --scanners vuln /usr/lib"]
163+
RUN ["/bin/bash", "-c", "trivy rootfs --exit-code 1 --ignore-unfixed --no-progress --severity HIGH,CRITICAL,MEDIUM --vuln-type os --scanners vuln --skip-files \"/usr/local/bin/trivy\" / > /dev/null 2>&1 && trivy rootfs --exit-code 1 --ignore-unfixed --no-progress --severity HIGH,CRITICAL,MEDIUM --vuln-type os --scanners vuln /usr/lib > /dev/null 2>&1"]
164+
165+
# Revert to base layer before vulnscan
166+
FROM distroless_image AS ContainerInsights
167+
# force the trivy stage to run
168+
# docker buildx (BUILDKIT) does not build stages which do not affect the final stage
169+
# by copying over a file we create a dependency
170+
# see: https://github.com/docker/build-push-action/issues/377
171+
COPY --from=vulnscan /usr/local/bin/trivy /usr/local/bin/trivy
172+
RUN ["/bin/bash", "-c", "rm -rf /usr/local/bin/trivy"]
173+
174+
CMD [ "/opt/main.sh" ]

kubernetes/linux/mariner-official-cloud-native-amd64.repo renamed to kubernetes/linux/azurelinux-official-cloud-native-amd64.repo

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
[mariner-official-cloud-native-amd64]
2-
name=CBL-Mariner Official Cloud Native Amd64
3-
baseurl=https://packages.microsoft.com/cbl-mariner/2.0/prod/cloud-native/x86_64
1+
[azurelinux-official-cloud-native-amd64]
2+
name=Azure-Linux Official Cloud Native Amd64
3+
baseurl=https://packages.microsoft.com/azurelinux/3.0/prod/cloud-native/x86_64
44
gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY file:///etc/pki/rpm-gpg/MICROSOFT-METADATA-GPG-KEY
55
gpgcheck=1
66
repo_gpgcheck=1

kubernetes/linux/mariner-official-cloud-native-arm64.repo renamed to kubernetes/linux/azurelinux-official-cloud-native-arm64.repo

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
[mariner-official-cloud-native-arm64]
2-
name=CBL-Mariner Official Cloud Native Arm64
3-
baseurl=https://packages.microsoft.com/cbl-mariner/2.0/prod/cloud-native/aarch64
1+
[azurelinux-official-cloud-native-arm64]
2+
name=Azure-Linux Official Cloud Native Arm64
3+
baseurl=https://packages.microsoft.com/azurelinux/3.0/prod/cloud-native/aarch64
44
gpgkey=file:///etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY file:///etc/pki/rpm-gpg/MICROSOFT-METADATA-GPG-KEY
55
gpgcheck=1
66
repo_gpgcheck=1

0 commit comments

Comments
 (0)