dev: Replace base images with high and critical severities#843
dev: Replace base images with high and critical severities#843FabijanC merged 5 commits into0xSpaceShard:mainfrom
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
FabijanC
left a comment
There was a problem hiding this comment.
Have you tried building this?
|
Hi @FabijanC The Dockerfile had no |
|
Thanks for the full report! I remember that Devnet's Dockerfile used to depend on alpine; not sure why it was changed. We should use git blame to find that out. |
|
Just checked, if it depended on alpine at any point, it wasn't committed to git or on main, it started out as 96622180 (FabijanC 2023-08-31) +FROM rust:1.69.0-slim-buster as builder
df1b2c3d (FabijanC 2023-12-07) +FROM rust:1.70.0-slim-buster as builder
6306ad65 (FabijanC 2024-03-01) +FROM rust:1.74.0-slim-buster as builder
9b40420b (FabijanC 2024-04-03) FROM debian:buster-slim (Multistage build was introduced here)
349abe52 (FabijanC 2024-07-23) +FROM rust:1.76.0-slim-buster as builder
3029c673 (FabijanC 2025-03-27) +FROM rust:1.85.0-slim-bullseye AS builder
+FROM debian:bullseye-slim (Multistage second stage base image changed here)
ce85ab2d (FabijanC 2025-07-14) +FROM rust:1.86.0-slim-bullseye AS builder |
|
Perhaps I confused it with the Dockerfile used in the old, Pythonic Devnet: https://github.com/0xSpaceShard/starknet-devnet-deprecated/blob/master/Dockerfile |
|
Yeah @FabijanC , happens to the best of us! |
FabijanC
left a comment
There was a problem hiding this comment.
Well, it all looks good. I'll just try building it myself and give final feedback.
|
Thank you, would be awaiting your feedback. |
There was a problem hiding this comment.
I think its better to have alpine versions pinned. As you can see, even in this example, versions between stages were inadvertently different. Patch versions, but still. Image rust:1.86-alpine3.22 doesn't exist so downgraded final stage to alpine:3.21.
Usage related changes
It provides them with a Devnet Image with a safer and lesser exposure to vulnerabilities exposed from the previous base images.
Development related changes
Images are now being built with alpine as the base.
Checklist:
./scripts/format.sh./scripts/clippy_check.sh./scripts/check_unused_deps.sh./scripts/check_spelling.sh./website/README.mdcloses #841