Fix vulnerabilities in the Dockerfile by eahefnawy · Pull Request #13395 · serverless/serverless

eahefnawy · 2026-03-08T22:19:36Z

Addresses: This PR fixes two zlib vulnerabilities (CVE-2026-22184 CRITICAL, CVE-2026-27171 MEDIUM) in the node:20-alpine base image for the dev-mode proxy. It adds apk update && apk upgrade --no-cache to the Dockerfile to update zlib from 1.3.1-r2 to 1.3.2-r0.

Summary by CodeRabbit

Chores
- Updated base image dependencies to enhance security and system stability in the development environment.

…ib vulnerabilities Adds 'apk update && apk upgrade' to the Dockerfile to resolve: - CVE-2026-22184 (CRITICAL): zlib out-of-bounds write (fixed in zlib 1.3.2-r0) - CVE-2026-27171 (MEDIUM): zlib improper validation of input (fixed in zlib 1.3.2-r0)

cursor · 2026-03-08T22:19:36Z

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

Mmarzex · 2026-03-08T22:19:46Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

coderabbitai · 2026-03-08T22:19:56Z

📝 Walkthrough

Walkthrough

A Dockerfile for the serverless dev-mode proxy was updated with an Alpine package refresh command. The RUN apk update && apk upgrade --no-cache instruction was added after the base image declaration to ensure the image contains the latest packages at build time.

Changes

Cohort / File(s)	Summary
Alpine Package Refresh `packages/engine/src/lib/devMode/containers/serverless-dev-mode-proxy/Dockerfile`	Added package update and upgrade instruction to refresh Alpine packages in the container image, improving security and freshness at build time.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A hop, a skip, through Alpine's veils so green,
Security packages, fresh and clean!
apk upgrade hops the stage with care,
Building stronger images in the mountain air.
Freshness assured with every Docker build! 🐇

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The PR title 'Fix vulnerabilities in the Dockerfile' directly relates to the main change, which adds Alpine package updates to patch zlib vulnerabilities (CVE-2026-22184 and CVE-2026-27171).

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings (stacked PR)
📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch cursor/identified-issue-d9a3

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

cursor · 2026-03-08T22:21:08Z

packages/engine/src/lib/devMode/containers/serverless-dev-mode-proxy/Dockerfile

@@ -1,5 +1,7 @@
 FROM node:20-alpine

+RUN apk update && apk upgrade --no-cache


Redundant apk update leaves cache in Docker image

Low Severity

The apk update before apk upgrade --no-cache is redundant and counterproductive. The --no-cache flag on apk upgrade already fetches the package index into memory and discards it after use. Running apk update separately first writes index files to /var/cache/apk/ that persist in the image layer, unnecessarily increasing image size. Using just apk upgrade --no-cache alone achieves the same result without the leftover cache.

not an issue

coderabbitai

🧹 Nitpick comments (1)

packages/engine/src/lib/devMode/containers/serverless-dev-mode-proxy/Dockerfile (1)
3-3: Prefer a deterministic zlib fix over a blanket apk upgrade.

Line 3 upgrades every installed Alpine package on each rebuild, not just zlib. Alpine documents that apk update refreshes repository indexes and apk upgrade updates installed packages, while Docker notes that mutable tags like node:20-alpine already drift over time and recommends pinning base images/digests for auditability. For this CVE fix, I’d rather pin a patched base image digest or apply a zlib-only/version-pinned upgrade so the image stays reproducible. (wiki.alpinelinux.org)
Possible direction
-FROM node:20-alpine
-RUN apk update && apk upgrade --no-cache
+FROM node:20-alpine@sha256:<patched-digest>
+# or, if the base image can't move yet:
+RUN apk add --no-cache 'zlib=1.3.2-r0'
Does the current official `node:20-alpine` image already include Alpine packages with `zlib` >= 1.3.2-r0, and what digest should be pinned in the Dockerfile to keep this fix reproducible?
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@packages/engine/src/lib/devMode/containers/serverless-dev-mode-proxy/Dockerfile`
at line 3, The Dockerfile uses a blanket "RUN apk update && apk upgrade
--no-cache" which makes builds non-deterministic; replace this with a
deterministic fix by either pinning the base image (node:20-alpine) to a
specific digest that includes the patched zlib, or remove the global upgrade and
instead install/upgrade only the zlib package to a specific patched version
(e.g., use apk add --no-cache zlib=<version>) and drop the apk upgrade step;
update the Dockerfile line containing RUN apk update && apk upgrade --no-cache
and ensure the chosen zlib version or the pinned node:20-alpine@sha256:<digest>
is recorded for reproducible builds.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In
`@packages/engine/src/lib/devMode/containers/serverless-dev-mode-proxy/Dockerfile`:
- Line 3: The Dockerfile uses a blanket "RUN apk update && apk upgrade
--no-cache" which makes builds non-deterministic; replace this with a
deterministic fix by either pinning the base image (node:20-alpine) to a
specific digest that includes the patched zlib, or remove the global upgrade and
instead install/upgrade only the zlib package to a specific patched version
(e.g., use apk add --no-cache zlib=<version>) and drop the apk upgrade step;
update the Dockerfile line containing RUN apk update && apk upgrade --no-cache
and ensure the chosen zlib version or the pinned node:20-alpine@sha256:<digest>
is recorded for reproducible builds.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: bfc8f7ed-41e6-4506-b93f-2139527e6e8e

📥 Commits

Reviewing files that changed from the base of the PR and between 067c242 and f1de5d3.

📒 Files selected for processing (1)

packages/engine/src/lib/devMode/containers/serverless-dev-mode-proxy/Dockerfile

eahefnawy marked this pull request as ready for review March 8, 2026 22:20

eahefnawy changed the title ~~Identified issue~~ Fix vulnerabilities in the DockerImage Mar 8, 2026

eahefnawy changed the title ~~Fix vulnerabilities in the DockerImage~~ Fix vulnerabilities in the Dockerfile Mar 8, 2026

cursor bot reviewed Mar 8, 2026

View reviewed changes

coderabbitai bot reviewed Mar 8, 2026

View reviewed changes

eahefnawy merged commit 8b9af0f into main Mar 8, 2026
14 checks passed

eahefnawy deleted the cursor/identified-issue-d9a3 branch March 8, 2026 22:30

github-actions bot locked and limited conversation to collaborators Mar 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix vulnerabilities in the Dockerfile#13395

Fix vulnerabilities in the Dockerfile#13395
eahefnawy merged 1 commit intomainfrom
cursor/identified-issue-d9a3

eahefnawy commented Mar 8, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

cursor bot commented Mar 8, 2026

Uh oh!

Mmarzex commented Mar 8, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Mar 8, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

cursor bot left a comment

Uh oh!

cursor bot Mar 8, 2026

Uh oh!

eahefnawy Mar 8, 2026

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -1,5 +1,7 @@
		FROM node:20-alpine

		RUN apk update && apk upgrade --no-cache

Conversation

eahefnawy commented Mar 8, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

cursor bot commented Mar 8, 2026

Uh oh!

Mmarzex commented Mar 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

coderabbitai bot commented Mar 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Mar 8, 2026

Choose a reason for hiding this comment

Redundant apk update leaves cache in Docker image

Uh oh!

eahefnawy Mar 8, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

eahefnawy commented Mar 8, 2026 •

edited by coderabbitai bot

Loading

Mmarzex commented Mar 8, 2026 •

edited

Loading

coderabbitai bot commented Mar 8, 2026 •

edited

Loading

Redundant `apk update` leaves cache in Docker image