Giters

ma1uta / ma1sd

Federated Matrix Identity Server (formerly fork of kamax/mxisd)

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Rebase containerimage to a supported version of openJDK

djpbessems opened this issue · comments

commented

Currently the container image is based on openjdk:8-jre-alpine. The latest release of ma1uta/ma1sd contains ~65 vulnerabilities (all fixable):
image

I tried to add a RUN apk upgrade --update-cache --available to your Dockerfile, which brought down the amount of vulnerabilities to 42 (all fixable):
image

Examining these vulnerabilities shows that they are all caused by a (severely) outdated openjdk version:
image

I wondered why these fixes were not included in your base image and quickly found this post:
docker-library/openjdk#272

As you can see, openJDK 8 is not a good candidate to base your image on anymore.

I found an alternative base image adoptopenjdk/openjdk11:alpine, and when I use that (including RUN apk upgrade --update-cache --available) I get no vulnerabilities anymore:
image
(I have not actually run the image yet, so don't actually know if it's fully compatible)