Skip to content

fix(kubernetes): eliminate Critical/High container CVEs (slim runtime base, Go 1.25, otel 1.43, Dependabot docker) #966

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dvaldivia wants to merge 4 commits into
base: main
Choose a base branch
from
Open

fix(kubernetes): eliminate Critical/High container CVEs (slim runtime base, Go 1.25, otel 1.43, Dependabot docker) #966

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ae1dc1b
fix(kubernetes): eliminate Critical/High CVEs via slim runtime base +…
dvaldivia Jun 1, 2026
c70c735
chore(ci): add Dependabot config and pin component base images
dvaldivia Jun 1, 2026
3d5869a
fix: address PR review comments
dvaldivia Jun 2, 2026
e1462b3
ci(kubernetes): bump CI Go to 1.25 to match go.mod
dvaldivia Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
99 changes: 99 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
# Dependabot configuration for OpenSandbox.
#
# This file makes the previously UI-only Dependabot setup reviewable in-tree and,
# critically, adds the "docker" ecosystem so container base images (golang, debian,
# alpine, python, ubuntu) are kept patched. Stale base images were the root cause of
# the bulk of the Critical/High OS-package CVEs found by Trivy: Go modules were being
# bumped but the images they ship in were never refreshed.
#
# Updates are grouped per ecosystem to keep PR volume manageable.
version: 2
updates:
# ---- Go modules ----------------------------------------------------------
- package-ecosystem: gomod
directories:
- /kubernetes
- /components/egress
- /components/execd
- /components/ingress
- /components/internal
- /sdks/sandbox/go
- /tests/go
- /examples/chrome
Comment thread
dvaldivia marked this conversation as resolved.
schedule:
interval: weekly
open-pull-requests-limit: 10
groups:
go-minor-patch:
update-types:
- minor
- patch

# ---- Container base images ----------------------------------------------
# The gap that let OS-package CVEs accumulate. Covers every Dockerfile dir;
# bases are pinned by tag@digest so Dependabot bumps both the tag and digest.
- package-ecosystem: docker
directories:
- /kubernetes
- /components/egress
- /components/execd
- /components/ingress
- /server
- /sandboxes/code-interpreter
- /examples/chrome
- /examples/desktop
- /examples/playwright
- /examples/vscode
schedule:
interval: weekly
open-pull-requests-limit: 10
groups:
docker-images:
patterns:
- "*"

# ---- Python (uv / pip) ---------------------------------------------------
- package-ecosystem: pip
Comment thread
dvaldivia marked this conversation as resolved.
Outdated
directories:
- /server
- /cli
- /sdks/code-interpreter/python
- /sdks/mcp/sandbox/python
- /sdks/sandbox/python
- /tests/python
schedule:
interval: weekly
open-pull-requests-limit: 10
groups:
python-minor-patch:
update-types:
- minor
- patch

# ---- JavaScript / npm ----------------------------------------------------
- package-ecosystem: npm
directories:
- /docs
- /sdks
- /sdks/code-interpreter/javascript
- /sdks/sandbox/javascript
Comment thread
dvaldivia marked this conversation as resolved.
Outdated
- /tests/javascript
schedule:
interval: weekly
open-pull-requests-limit: 10
groups:
npm-minor-patch:
update-types:
- minor
- patch

# ---- GitHub Actions ------------------------------------------------------
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
open-pull-requests-limit: 5
groups:
actions:
patterns:
- "*"
3 changes: 2 additions & 1 deletion components/execd/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,8 @@ RUN CGO_ENABLED=0 GOOS=windows go build ${GOFLAGS} -trimpath -buildvcs=false \
-X 'github.com/alibaba/opensandbox/internal/version.GitCommit=${GIT_COMMIT}'" \
-o /build/execd.exe ./main.go

FROM alpine:latest
# Pinned by tag@digest for reproducibility; Dependabot keeps both current.
FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d

COPY --from=builder /build/execd .
COPY --from=builder /build/execd.exe ./execd.exe
Expand Down
3 changes: 2 additions & 1 deletion components/ingress/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,8 @@ RUN if [ -n "${CC}" ]; then export CC; fi; \
-X 'github.com/alibaba/opensandbox/internal/version.GitCommit=${GIT_COMMIT}'" \
-o /build/ingress ./main.go

FROM alpine:latest
# Pinned by tag@digest for reproducibility; Dependabot keeps both current.
FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d

COPY --from=builder /build/ingress .

Expand Down
27 changes: 23 additions & 4 deletions kubernetes/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,9 @@
# limitations under the License.

# Build the manager binary
FROM golang:1.24 AS builder
# Go 1.25 (>=1.25.10) is required to pick up Go stdlib security fixes; the 1.24
# branch is EOL for them. Pinned by digest (dependabot keeps tag+digest current).
FROM golang:1.25@sha256:c138bff780910acf4254ab3a6f7ff0f64bbd841f27bd82bfa986fe122c109538 AS builder
Comment thread
dvaldivia marked this conversation as resolved.
Outdated
ARG TARGETOS
ARG TARGETARCH
ARG GOFLAGS=
Expand Down Expand Up @@ -60,10 +62,27 @@ RUN if [ -n "${CC}" ]; then export CC; fi; \
-ldflags "${LDFLAGS} -buildid= -B none -X main.commitID=${COMMIT_ID} -X main.buildDate=${BUILD_DATE}" \
-o server ${PACKAGE}

# Use golang image as base to ensure nsenter (util-linux) is available
# distroless does not contain shell or nsenter
FROM golang:1.24
# Minimal runtime instead of the full golang toolchain image (which shipped the
# entire Debian 13 userland + build tools -> hundreds of OS-package CVEs).
# The task-executor needs nsenter + /bin/sh; the controller shells out to nothing.
# distroless is unusable here because it has neither nsenter nor a shell.
# Pinned by digest (dependabot keeps tag+digest current).
FROM debian:13-slim@sha256:b6e2a152f22a40ff69d92cb397223c906017e1391a73c952b588e51af8883bf8
ARG USERID=65532

# Apply outstanding security patches (clears the fixable OpenSSL CVEs) and install
# ONLY the runtime deps. In Debian trixie nsenter lives in util-linux-extra
# (util-linux merely Recommends it), so install util-linux-extra explicitly.
RUN apt-get update \
&& apt-get upgrade -y --no-install-recommends \
&& apt-get install -y --no-install-recommends \
util-linux-extra \
ca-certificates \
&& rm -rf /var/lib/apt/lists/*
Comment thread
dvaldivia marked this conversation as resolved.

# Fail the build early if the runtime deps are missing.
RUN command -v nsenter >/dev/null && [ -x /bin/sh ]

WORKDIR /workspace
COPY --from=builder /workspace/server .
USER $USERID
Expand Down
7 changes: 5 additions & 2 deletions kubernetes/Dockerfile.image-committer
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,9 @@
# limitations under the License.

# Build stage
FROM golang:1.24-alpine AS builder
# Go 1.25 to match the go.mod directive (the kubernetes module requires go 1.25).
# Pinned by tag@digest; Dependabot keeps both current.
FROM golang:1.25-alpine@sha256:8d22e29d960bc50cd025d93d5b7c7d220b1ee9aa7a239b3c8f55a57e987e8d45 AS builder

# Use Aliyun mirror for faster downloads in China
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
Expand All @@ -31,7 +33,8 @@ COPY cmd/image-committer/ cmd/image-committer/
RUN CGO_ENABLED=0 GOOS=linux go build -o /usr/local/bin/image-committer ./cmd/image-committer/

# Runtime stage
FROM alpine:3.19
# Pinned by tag@digest for reproducibility; Dependabot keeps both current.
FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d

# Use Aliyun mirror for faster downloads in China
RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
Expand Down
38 changes: 19 additions & 19 deletions kubernetes/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/alibaba/OpenSandbox/sandbox-k8s

go 1.24.0
go 1.25.0

require (
github.com/golang/mock v1.6.0
Expand Down Expand Up @@ -50,7 +50,7 @@ require (
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
Expand All @@ -70,28 +70,28 @@ require (
github.com/x448/float16 v0.8.4 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
go.opentelemetry.io/otel v1.41.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
go.opentelemetry.io/otel/metric v1.41.0 // indirect
go.opentelemetry.io/otel/sdk v1.41.0 // indirect
go.opentelemetry.io/otel/trace v1.41.0 // indirect
go.opentelemetry.io/proto/otlp v1.9.0 // indirect
go.opentelemetry.io/otel v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
go.opentelemetry.io/otel/metric v1.43.0 // indirect
go.opentelemetry.io/otel/sdk v1.43.0 // indirect
go.opentelemetry.io/otel/trace v1.43.0 // indirect
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
golang.org/x/net v0.50.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sync v0.19.0 // indirect
golang.org/x/sys v0.41.0 // indirect
golang.org/x/term v0.40.0 // indirect
golang.org/x/text v0.34.0 // indirect
golang.org/x/net v0.52.0 // indirect
golang.org/x/oauth2 v0.35.0 // indirect
golang.org/x/sync v0.20.0 // indirect
golang.org/x/sys v0.42.0 // indirect
golang.org/x/term v0.41.0 // indirect
golang.org/x/text v0.35.0 // indirect
golang.org/x/time v0.9.0 // indirect
golang.org/x/tools v0.41.0 // indirect
golang.org/x/tools v0.42.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 // indirect
google.golang.org/grpc v1.79.3 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
google.golang.org/grpc v1.80.0 // indirect
google.golang.org/protobuf v1.36.11 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
Expand Down
Loading
Loading