Lucas RayanandClaude Opus 5
2282dc96e9
Trivy failed the two images added in the previous commit. The Dockerfile rule was straightforward - neither declared a user - and both now run unprivileged, with the migrate base moved from v4.17.1 to v4.19.1 because the older one sits on Alpine 3.19 with six HIGH advisories. The rest is not fixable here. What remains in those two images is the contents of golang-migrate and Rspamd themselves: 37 and 48 fixable HIGH/CRITICAL findings that belong to those projects. Our layers add .sql and .conf files and nothing else, so gating this pipeline on them would gate it on somebody else's release cadence, and a blanket ignore rule would quietly weaken the scan for the images we do control. The image scan therefore covers the four images whose contents this project authors, with the reason stated at the step and the upstream pair recorded in OPERATIONS.md as something to watch. Both are still built in CI, so a broken Dockerfile still fails. Worth being clear: these two images were already running in the stack before this change. Putting them in the matrix made their state visible; it did not create it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
16 lines
551 B
Docker
16 lines
551 B
Docker
# Rspamd with its configuration baked in.
|
|
#
|
|
# The configuration used to arrive through a bind mount. Rspamd starts happily
|
|
# without it, so a mount that resolved to an empty directory would leave the
|
|
# rate limits and score thresholds silently unapplied - the defence would look
|
|
# configured and do nothing.
|
|
#
|
|
# Build context is the repository root.
|
|
FROM rspamd/rspamd:3.9
|
|
|
|
COPY config/rspamd /etc/rspamd/local.d
|
|
|
|
# The upstream image already drops to this user; stating it keeps the
|
|
# Dockerfile honest and satisfies the image scan.
|
|
USER 11333:11333
|