arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-11-30 03:48:13 +00:00
Code Issues Releases Wiki Activity
651f12d21c
kube-bench/Dockerfile

50 lines
1.7 KiB
Docker
Raw Normal View History

Bump docker base images (#1465) During a recent CVE scan we found kube-bench to use `alpine:3.18` as the final image which has a known high CVE. ``` grype aquasec/kube-bench:v0.6.15 ✔ Vulnerability DB [no update available] ✔ Loaded image ✔ Parsed image ✔ Cataloged packages [73 packages] ✔ Scanning image... [4 vulnerabilities] ├── 0 critical, 4 high, 0 medium, 0 low, 0 negligible └── 4 fixed NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY libcrypto3 3.1.0-r4 3.1.1-r0 apk CVE-2023-2650 High libssl3 3.1.0-r4 3.1.1-r0 apk CVE-2023-2650 High openssl 3.1.0-r4 3.1.1-r0 apk CVE-2023-2650 High ``` The CVE in question was addressed in the latest [alpine release](https://www.alpinelinux.org/posts/Alpine-3.15.9-3.16.6-3.17.4-3.18.2-released.html), hence updating the dockerfiles accordingly
2023-07-26 15:22:19 +00:00
FROM golang:1.20.6 AS build
Allow kube-bench to be run inside its distribution container
2018-05-06 18:35:23 +00:00
WORKDIR /go/src/github.com/aquasecurity/kube-bench/
Support arm64 architecture (#1036) * Support arm64 architecture * remove .github/workflows/test_docker.yml Co-authored-by: Yoav Rotem <yoavrotems97@gmail.com>
2021-11-08 12:06:44 +00:00
COPY makefile makefile
Use COPY instead of ADD in Dockerfile (#502)
2019-11-27 16:25:19 +00:00
COPY go.mod go.sum ./
COPY main.go .
COPY check/ check/
COPY cmd/ cmd/
Aws asff (#770) * add aasf * add AASF format * credentials provider * add finding publisher * add finding publisher * add write AASF path * add testing * read config from file * update docker file * refactor * remove sample * add comments * Add comment in EKS config.yaml * Fix comment typo * Fix spelling of ASFF * Fix typo and other small code review suggestions * Limit length of Actual result field Avoids this message seen in testing: Message:Finding does not adhere to Amazon Finding Format. data.ProductFields['Actual result'] should NOT be longer than 1024 characters. * Add comment for ASFF schema * Add Security Hub documentation * go mod tidy * remove dupe lines in docs * support integration in any region * fix README link * fix README links Co-authored-by: Liz Rice <liz@lizrice.com>
2020-11-23 19:43:53 +00:00
COPY internal/ internal/
passes KUBEBENCH_VERSION down to Dockerfile (#428)
2019-10-12 22:53:17 +00:00
ARG KUBEBENCH_VERSION
Support arm64 architecture (#1036) * Support arm64 architecture * remove .github/workflows/test_docker.yml Co-authored-by: Yoav Rotem <yoavrotems97@gmail.com>
2021-11-08 12:06:44 +00:00
RUN make build && cp kube-bench /go/bin/kube-bench
Dockerfile fix to copy all the cfg files
2017-10-02 10:38:45 +00:00
Bump docker base images (#1465) During a recent CVE scan we found kube-bench to use `alpine:3.18` as the final image which has a known high CVE. ``` grype aquasec/kube-bench:v0.6.15 ✔ Vulnerability DB [no update available] ✔ Loaded image ✔ Parsed image ✔ Cataloged packages [73 packages] ✔ Scanning image... [4 vulnerabilities] ├── 0 critical, 4 high, 0 medium, 0 low, 0 negligible └── 4 fixed NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY libcrypto3 3.1.0-r4 3.1.1-r0 apk CVE-2023-2650 High libssl3 3.1.0-r4 3.1.1-r0 apk CVE-2023-2650 High openssl 3.1.0-r4 3.1.1-r0 apk CVE-2023-2650 High ``` The CVE in question was addressed in the latest [alpine release](https://www.alpinelinux.org/posts/Alpine-3.15.9-3.16.6-3.17.4-3.18.2-released.html), hence updating the dockerfiles accordingly
2023-07-26 15:22:19 +00:00
FROM alpine:3.18.2 AS run
Allow kube-bench to be run inside its distribution container
2018-05-06 18:35:23 +00:00
WORKDIR /opt/kube-bench/
# add GNU ps for -C, -o cmd, and --no-headers support
# https://github.com/aquasecurity/kube-bench/issues/109
RUN apk --no-cache add procps
Fixes Issue #535 (#537) * isEtcd should not run on openshift 3.10/3.11 * adds openssl * fixed tests * fixes bugs * adds isEtcd tests
2019-12-13 15:09:30 +00:00
Upgrading apk-tools (#944) Upgrading apk-tools to remediate CVE-2021-36159 ( https://snyk.io/vuln/SNYK-ALPINE314-APKTOOLS-1533752 ) Fixes #943 Signed-off-by: Dave Hay <david_hay@uk.ibm.com> Co-authored-by: Yoav Rotem <yoavrotems97@gmail.com>
2021-08-03 14:21:24 +00:00
# Upgrading apk-tools to remediate CVE-2021-36159 - https://snyk.io/vuln/SNYK-ALPINE314-APKTOOLS-1533752
# https://github.com/aquasecurity/kube-bench/issues/943
RUN apk --no-cache upgrade apk-tools
Fixes Issue #535 (#537) * isEtcd should not run on openshift 3.10/3.11 * adds openssl * fixed tests * fixes bugs * adds isEtcd tests
2019-12-13 15:09:30 +00:00
# Openssl is used by OpenShift tests
# https://github.com/aquasecurity/kube-bench/issues/535
Update/upgrade Alpine before installing openssl (#981) Mitigating CVE-2021-3711 and CVE-2021-3712 Signed-off-by: Dave Hay <david_hay@uk.ibm.com> Co-authored-by: Yoav Rotem <yoavrotems97@gmail.com>
2021-09-05 14:48:33 +00:00
# Ensuring that we update/upgrade before installing openssl, to mitigate CVE-2021-3711 and CVE-2021-3712
RUN apk update && apk upgrade && apk --no-cache add openssl
Fixes Issue #535 (#537) * isEtcd should not run on openshift 3.10/3.11 * adds openssl * fixed tests * fixes bugs * adds isEtcd tests
2019-12-13 15:09:30 +00:00
Fix ocp job issues (#893) * Fix openshift missing glibc Fixing issues #891 #890 * Update goreleaser Change release to build, no need to release while building (when pushed to main) but only when publishing (release new version) * Update goreleaser version to 0.169.0 * Change from release to build * Try day run on release It used to be released to docker hub each push, the issue was that docker hub had a automation for it, now test if its not releasing every git push.
2021-06-09 12:34:39 +00:00
# Add glibc for running oc command
RUN wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub
chore: replace gclib alpine pkg (#1280) * chore: replace gclib alpine pkg Signed-off-by: chenk <hen.keinan@gmail.com> * chore: replace gclib alpine pkg Signed-off-by: chenk <hen.keinan@gmail.com> Signed-off-by: chenk <hen.keinan@gmail.com>
2022-09-14 13:59:58 +00:00
RUN apk add gcompat
Fix ocp job issues (#893) * Fix openshift missing glibc Fixing issues #891 #890 * Update goreleaser Change release to build, no need to release while building (when pushed to main) but only when publishing (release new version) * Update goreleaser version to 0.169.0 * Change from release to build * Try day run on release It used to be released to docker hub each push, the issue was that docker hub had a automation for it, now test if its not releasing every git push.
2021-06-09 12:34:39 +00:00
RUN apk add jq
Fixes issue #574: change the PATH in container (#577) * Fixes issue #574: change the PATH in container And change to use `/usr/local/mount-from-host/bin` as mount path. Fixes #574 * Fix integration tests
2020-02-12 17:18:44 +00:00
ENV PATH=$PATH:/usr/local/mount-from-host/bin
Allow kube-bench to be run inside its distribution container
2018-05-06 18:35:23 +00:00
COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
Use COPY instead of ADD in Dockerfile (#502)
2019-11-27 16:25:19 +00:00
COPY entrypoint.sh .
COPY cfg/ cfg/
Allow kube-bench to be run inside its distribution container
2018-05-06 18:35:23 +00:00
ENTRYPOINT ["./entrypoint.sh"]
Install binary and configs as the default behavior
2018-05-07 02:18:47 +00:00
CMD ["install"]
Add image labels
2017-06-22 15:15:12 +00:00
# Build-time metadata as defined at http://label-schema.org
ARG BUILD_DATE
ARG VCS_REF
LABEL org.label-schema.build-date=$BUILD_DATE \
org.label-schema.name="kube-bench" \
org.label-schema.description="Run the CIS Kubernetes Benchmark tests" \
org.label-schema.url="https://github.com/aquasecurity/kube-bench" \
org.label-schema.vcs-ref=$VCS_REF \
org.label-schema.vcs-url="https://github.com/aquasecurity/kube-bench" \
org.label-schema.schema-version="1.0"
Reference in New Issue Copy Permalink