6b45c813

site: the image takes its fixes from the distro, not the base tag

a73x 2026-09-05 18:05

Commit message

site: the image takes its fixes from the distro, not the base tag

nginx:alpine lags Alpine's package repo, so an image built while a
util-linux advisory is open carries the vulnerable libuuid and the ship
pipeline's HIGH/CRITICAL scan refuses to publish it — correctly. Upgrade
at build time so the gate is answered by the distro rather than by
whenever the base is next rebuilt upstream.

RETRO.md

Old		New
@@ -81,3 +81,9 @@ One line per push to `main`: what slowed the work down. Enforced by
81	the new cloud-init test replaced wholesale stopped registering its VM, so the	81	the new cloud-init test replaced wholesale stopped registering its VM, so the
82	first ci after a clean rebase failed in two places that had nothing to do	82	first ci after a clean rebase failed in two places that had nothing to do
83	with volumes.	83	with volumes.
		84	- Site image: the ship stopped at stage 3 because nginx:alpine still carried
		85	seven HIGH util-linux advisories that Alpine had already fixed in its own
		86	package repo, and the image gate is right to refuse them. The base tag lags
		87	the distro, so a build is only as current as whenever upstream last rebuilt;
		88	taking the upgrade at build time is the difference between shipping and
		89	waiting on someone else's release cadence.

site/Dockerfile

Old		New
@@ -1,3 +1,10 @@
1	FROM docker.io/library/nginx:alpine	1	FROM docker.io/library/nginx:alpine
		2
		3	# The nginx:alpine tag lags Alpine's own package repo, so an image built the day
		4	# a util-linux advisory lands still carries the vulnerable libuuid and the ship
		5	# pipeline's HIGH/CRITICAL scan refuses to publish it. Take the fixes from the
		6	# distro rather than waiting for the base to be rebuilt upstream.
		7	RUN apk --no-cache upgrade
		8
2	COPY site/nginx.conf /etc/nginx/conf.d/default.conf	9	COPY site/nginx.conf /etc/nginx/conf.d/default.conf
3	COPY site/dist/ /usr/share/nginx/html/	10	COPY site/dist/ /usr/share/nginx/html/