Lucas RayanandClaude Opus 5
2282dc96e9
Trivy failed the two images added in the previous commit. The Dockerfile rule was straightforward - neither declared a user - and both now run unprivileged, with the migrate base moved from v4.17.1 to v4.19.1 because the older one sits on Alpine 3.19 with six HIGH advisories. The rest is not fixable here. What remains in those two images is the contents of golang-migrate and Rspamd themselves: 37 and 48 fixable HIGH/CRITICAL findings that belong to those projects. Our layers add .sql and .conf files and nothing else, so gating this pipeline on them would gate it on somebody else's release cadence, and a blanket ignore rule would quietly weaken the scan for the images we do control. The image scan therefore covers the four images whose contents this project authors, with the reason stated at the step and the upstream pair recorded in OPERATIONS.md as something to watch. Both are still built in CI, so a broken Dockerfile still fails. Worth being clear: these two images were already running in the stack before this change. Putting them in the matrix made their state visible; it did not create it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
23 lines
901 B
Docker
23 lines
901 B
Docker
# The migrations travel inside an image rather than a bind mount.
|
|
#
|
|
# A deployment that pulls its images has no reason to also depend on files
|
|
# being present at a particular path on the host: the orchestrator rewrites
|
|
# relative bind mounts to its own layout, and an empty directory silently
|
|
# becomes "no migrations found" - which fails the deploy with no useful error.
|
|
#
|
|
# Build context is the repository root.
|
|
# v4.19.1: the v4.17.1 image is built on Alpine 3.19 and carries six HIGH OS
|
|
# advisories plus a long tail in its own binary.
|
|
FROM migrate/migrate:v4.19.1
|
|
|
|
# Pending OS patches land only with an explicit upgrade.
|
|
RUN apk upgrade --no-cache
|
|
|
|
COPY migrations /migrations
|
|
|
|
# Applying a schema needs a database connection, not root on the container.
|
|
RUN addgroup -g 10002 -S migrate && adduser -u 10002 -S -G migrate migrate
|
|
USER migrate:migrate
|
|
|
|
ENTRYPOINT ["migrate", "-path=/migrations"]
|