From 4ce0e6c5ce998cc0d1aff95af405f1a1df1589e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Wed, 26 Aug 2026 19:39:51 +0200 Subject: [PATCH] Patch OS packages in the runtime image at build time Trivy flags CVE-2026-14456 (openssl denial of service via unbounded memory growth in the QUIC server) in the runner stage: the pinned node:22-alpine digest ships libssl3/libcrypto3 3.5.7-r0 and the fix is published as 3.5.8-r0 in the Alpine repo. An apk upgrade in the runner stage picks up published OS security fixes without giving up the digest pin, closing the window between a CVE landing in the secdb and the next base-image rebuild. --- Dockerfile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 8ab75ed66..0de6f3ccb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -60,7 +60,13 @@ FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb # `tzdata` is required so Europe/Berlin schedules (pg-boss cron, locale-aware # timestamp formatting) resolve to the actual offset instead of silently # falling back to UTC on Alpine images that ship without it. -RUN apk add --no-cache tzdata +# +# `apk upgrade` pulls in OS-package security fixes the pinned base digest +# has not absorbed yet (the digest pin stays for build reproducibility; +# security patches from the Alpine repo override it deliberately — +# CVE-2026-14456 in openssl was the first instance the container scan +# caught between base-image rebuilds). +RUN apk add --no-cache tzdata && apk upgrade --no-cache WORKDIR /app ENV NODE_ENV=production