How to create Multi-stage Docker image with Kafka-connect? Critical Issues Strimzi Kafka Docker Image

[imrohankataria]

Hi,

My Team is planned for Go-live next week but the latest strimzi has issues in the image, and thats coming as a blocker for our release.
Any suggestions on how to fix these issues? I also looked at https://quay.io/repository/strimzi/kafka/manifest/sha256:2fed0b67104b52214cde95cd6727a5609c728d63e601e19e32e7bfe95186abc3?tab=vulnerabilities How are these issues going to be addressed? and when? Thanks

Image scan by security team -

UPDATE:

My Team is using Strimzi Kafka connect in enterprise setting, and because of the image straight from quay.io we are seeing lots of vulnerabilities in the image.

To resolve those CVEs, I have been able to drop the folders/utilities that are not being used eg. kafa-exporter, cruise-control, etc

But the issues are still coming up because of Shasum history in the docker image. One resolution I tried before was squashing the images, but it is not working anymore.

Another approach is creating a Multi-stage image, which Im failing to create.

Will appreciate your help on this.

Code I have been trying to use -

FROM quay.io/strimzi/kafka:0.36.1-kafka-3.5.1 as builder

# Switch to root user to make modifications
USER root

# Remove unwanted components
RUN rm -rf /opt/kafka-exporter /opt/cruise-control

# Remove the old guava library
RUN rm /opt/kafka/libs/guava-30.1-jre.jar

# # Stage 2: Final Alpine-based image
FROM alpine:latest

# # Create Kafka user with similar properties to Strimzi's Kafka user
RUN addgroup -g 1001 -S kafka && adduser -u 1001 -S kafka -G kafka

# # Copy necessary files from the builder stage, retaining permissions
COPY --from=builder --chown=kafka:kafka /opt/kafka /opt/kafka

# # Add full permissions for the 'kafka' group to the /opt/kafka directory
RUN chmod -R g+rwx /opt/kafka

# Switch to Kafka user
USER kafka

[imrohankataria]

@scholzj Hello Sir, any suggestions?

[imrohankataria]

you're right
on docker inspect it comes arm and then AKS is amd

[scholzj]

Use this command to build amd64 images on my Arm-based mac: docker build --platform linux/amd64 ... ... not sure if it works everywhere.

[imrohankataria]

All works fine. I will close this out in a few if no other issue comes.

[imrohankataria]

How to go about these high issues within Strimzi? This is for com.google.guava, python-3libs, pip:9.0.3 ?

[scholzj]

You would need to look into them, where they are and see if you can somehow fix them. You should also thing whether you are really affected by any of these.

[imrohankataria]

Wow, squash worked. Next step - test this image

[imrohankataria]

If anyone is following this thread, follow below steps -

1. cd ~/.docker/
2. VIM daemon.json
3. Change experimental to true
4. docker build --squash -t img:tag .

[imrohankataria]

@scholzj looks like this feature is not available in docker anymore.
Do you have any guidelines on how to create a multi-stage docker image for strimzi?

I have been trying something like below but doesn't work

FROM quay.io/strimzi/kafka:0.36.1-kafka-3.5.1 as builder

# Switch to root user to make modifications
USER root

# Remove unwanted components
RUN rm -rf /opt/kafka-exporter /opt/cruise-control

# Remove the old guava library
RUN rm /opt/kafka/libs/guava-30.1-jre.jar

# # Stage 2: Final Alpine-based image
FROM alpine:latest

# # Create Kafka user with similar properties to Strimzi's Kafka user
RUN addgroup -g 1001 -S kafka && adduser -u 1001 -S kafka -G kafka

# # Copy necessary files from the builder stage, retaining permissions
COPY --from=builder --chown=kafka:kafka /opt/kafka /opt/kafka

# # Add full permissions for the 'kafka' group to the /opt/kafka directory
RUN chmod -R g+rwx /opt/kafka

# Switch to Kafka user
USER kafka```

[scholzj]

This is not really how it works. You cannot just change the base image like this. Especially not to Alpine that is typically missing many libraries available on other Linux distributions.

[imrohankataria]

@scholzj Can you please put me in a right direction?
I need to get rid of other layers to be CVE free

[scholzj]

I don't know how to do it. I assume there will be other tools to squash the layers? I'm afraid you will have to figure it out yourself.