From 7786a0479b0895b3f69e4acd846c9cc4e41a9553 Mon Sep 17 00:00:00 2001 From: Michael Guarino Date: Sun, 27 Sep 2026 00:11:59 +0000 Subject: [PATCH 1/6] fix(security): remediate PROD-5198 dependency and container alerts --- Dockerfile | 1 + dockerfiles/Dockerfile.softserve | 7 +++---- dockerfiles/Dockerfile.test | 5 ++++- go/ai-proxy/Dockerfile | 1 + go/cloud-query/Dockerfile | 5 +++-- go/controller/Dockerfile | 1 + go/datastore/Dockerfile | 1 + go/datastore/go.mod | 2 +- go/datastore/go.sum | 2 ++ go/demo/flaky-service/Dockerfile | 7 +++++-- go/demo/flaky-service/Dockerfile.sidecar | 3 +++ go/deployment-operator/Dockerfile | 1 + .../dockerfiles/agent-harness/claude.Dockerfile | 2 ++ .../dockerfiles/agent-harness/codex.Dockerfile | 2 ++ .../dockerfiles/agent-harness/opencode.Dockerfile | 2 ++ .../dockerfiles/mcpserver/terraform-server/Dockerfile | 5 ++++- go/deployment-operator/terratest/go.mod | 10 +++++----- go/deployment-operator/terratest/go.sum | 11 +++++++++++ go/helm-test/go.mod | 2 +- go/kubernetes-agent/api/Dockerfile | 1 + go/kubernetes-agent/hack/docker/Dockerfile | 2 ++ go/kubernetes-agent/hack/docker/Dockerfile.agentk | 2 ++ go/nexus/Dockerfile | 1 + go/observability-proxy/Dockerfile | 1 + go/oci-auth/Dockerfile | 1 + go/tools/go.mod | 2 +- js/console/Dockerfile | 3 +++ js/documentation/Dockerfile | 3 +++ mix.exs | 2 +- mix.lock | 2 +- repository-prebake/base/Dockerfile | 4 ++++ repository-prebake/console/Dockerfile | 3 ++- rust/embedding-server/Dockerfile | 4 ++++ 33 files changed, 80 insertions(+), 21 deletions(-) diff --git a/Dockerfile b/Dockerfile index 495e90dc88..4851fecfe3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -153,3 +153,4 @@ USER console EXPOSE 4000 6000 4369 50051 CMD mkdir -p /tmp/sqlite; /opt/app/bin/console start +HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 CMD ["/bin/sh", "-c", "wget -q -O /dev/null http://127.0.0.1:4000/health || wget -q -O /dev/null http://127.0.0.1:4000/"] diff --git a/dockerfiles/Dockerfile.softserve b/dockerfiles/Dockerfile.softserve index 84fe323c59..55ea15cd84 100644 --- a/dockerfiles/Dockerfile.softserve +++ b/dockerfiles/Dockerfile.softserve @@ -12,10 +12,9 @@ EXPOSE 23233 EXPOSE 9418 # basics, in case need to access shell to debug/troubleshoot -RUN apk update --no-cache # Upgrade OpenSSL packages to fix CVE-2025-1670 (NULL pointer dereference in CMS EnvelopedData processing) # and QUIC PATH_CHALLENGE DoS vulnerability -RUN apk add --no-cache "libssl3>=3.5.7-r0" "libcrypto3>=3.5.7-r0" +RUN apk update --no-cache && apk add --no-cache "libssl3>=3.5.7-r0" "libcrypto3>=3.5.7-r0" # Upgrade libexpat to fix authorization bypass vulnerability allowing arbitrary SQL execution RUN apk upgrade --no-cache libexpat # Upgrade zlib to fix buffer overflow vulnerability in untgz utility (CVE in zlib <= 1.3.1) @@ -51,10 +50,9 @@ EXPOSE 23233 EXPOSE 9418 # needs git for repos to be accessible -RUN apk update --no-cache # Upgrade OpenSSL packages to fix CVE-2025-1670 (NULL pointer dereference in CMS EnvelopedData processing) # and QUIC PATH_CHALLENGE DoS vulnerability -RUN apk add --no-cache "libssl3>=3.5.7-r0" "libcrypto3>=3.5.7-r0" +RUN apk update --no-cache && apk add --no-cache "libssl3>=3.5.7-r0" "libcrypto3>=3.5.7-r0" # Upgrade libexpat to fix authorization bypass vulnerability allowing arbitrary SQL execution RUN apk upgrade --no-cache libexpat musl musl-utils zlib RUN apk add --no-cache git @@ -68,3 +66,4 @@ RUN chown -R softserve:softserve /data USER softserve ENTRYPOINT [ "soft", "serve" ] +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["soft", "--help"] diff --git a/dockerfiles/Dockerfile.test b/dockerfiles/Dockerfile.test index 9aadf2cbf3..a9b2f305f3 100644 --- a/dockerfiles/Dockerfile.test +++ b/dockerfiles/Dockerfile.test @@ -17,10 +17,13 @@ RUN if [ "$OS_VARIANT" = "alpine" ]; then \ apk update && apk upgrade --no-cache && \ apk add --no-cache git build-base curl ca-certificates; \ else \ - apt-get update && apt-get install -y git build-essential curl ca-certificates; \ + apt-get update && apt-get install -y --no-install-recommends git build-essential curl ca-certificates; \ rm -rf "${RUSTUP_HOME}" "${CARGO_HOME}"; \ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain ${RUST_TOOLCHAIN}; \ fi && \ if [ "$OS_VARIANT" != "alpine" ]; then rustc --version && cargo --version; fi && \ mix local.rebar --force && \ mix local.hex --force +RUN addgroup -S app && adduser -S -G app app && chown -R app:app /app /usr/local/cargo /usr/local/rustup +USER app +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["mix", "--version"] diff --git a/go/ai-proxy/Dockerfile b/go/ai-proxy/Dockerfile index 48dcd04161..7965c7a591 100644 --- a/go/ai-proxy/Dockerfile +++ b/go/ai-proxy/Dockerfile @@ -39,3 +39,4 @@ COPY --from=builder /workspace/ai-proxy . USER 65532:65532 ENTRYPOINT ["/ai-proxy"] +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/ai-proxy", "--help"] diff --git a/go/cloud-query/Dockerfile b/go/cloud-query/Dockerfile index 7098a2d319..40f418dac0 100644 --- a/go/cloud-query/Dockerfile +++ b/go/cloud-query/Dockerfile @@ -16,7 +16,7 @@ COPY internal/ internal/ # Build the cloud-query binary RUN CGO_ENABLED=0 go build -o bin/cloud-query cmd/*.go -FROM cgr.dev/chainguard/wolfi-base AS final +FROM cgr.dev/chainguard/wolfi-base:latest AS final ARG BUILD_TIME=1970-01-01T00:00:00Z ARG GIT_COMMIT=unknown @@ -42,4 +42,5 @@ COPY --from=builder /workspace/bin/cloud-query /usr/local/bin/cloud-query USER nonroot -CMD ["/usr/local/bin/cloud-query"] \ No newline at end of file +CMD ["/usr/local/bin/cloud-query"]EXPOSE 8080 +HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["/usr/local/bin/cloud-query", "--help"] diff --git a/go/controller/Dockerfile b/go/controller/Dockerfile index 1ac246abef..5283060c11 100644 --- a/go/controller/Dockerfile +++ b/go/controller/Dockerfile @@ -58,3 +58,4 @@ COPY --from=builder /workspace/controller/manager . USER 65532:65532 ENTRYPOINT ["/manager"] +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/manager", "--help"] diff --git a/go/datastore/Dockerfile b/go/datastore/Dockerfile index c9f6441f74..9724a755b5 100644 --- a/go/datastore/Dockerfile +++ b/go/datastore/Dockerfile @@ -39,3 +39,4 @@ COPY --from=builder /workspace/controller/manager . USER 65532:65532 ENTRYPOINT ["/manager"] +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/manager", "--help"] diff --git a/go/datastore/go.mod b/go/datastore/go.mod index 59120c2ea0..6bc3e359b4 100644 --- a/go/datastore/go.mod +++ b/go/datastore/go.mod @@ -164,7 +164,7 @@ require ( gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect - google.golang.org/grpc v1.83.0 // indirect + google.golang.org/grpc v1.83.2 // indirect google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect diff --git a/go/datastore/go.sum b/go/datastore/go.sum index 63a0f94e76..b83c6560d6 100644 --- a/go/datastore/go.sum +++ b/go/datastore/go.sum @@ -481,6 +481,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ= google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/go/demo/flaky-service/Dockerfile b/go/demo/flaky-service/Dockerfile index 5aa10bb16f..a6ae8335f9 100644 --- a/go/demo/flaky-service/Dockerfile +++ b/go/demo/flaky-service/Dockerfile @@ -17,13 +17,14 @@ COPY . . RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o flaky-service . # Step 2: Create a smaller image to run the application -FROM alpine:latest +FROM alpine:3.22 # Install necessary dependencies to run Go binaries RUN apk --no-cache add ca-certificates # Set the Current Working Directory inside the container -WORKDIR /root/ +WORKDIR /app +RUN adduser -D -u 65532 flaky && chown flaky:flaky /app # Copy the Go binary from the build stage COPY --from=build /app/flaky-service . @@ -34,3 +35,5 @@ EXPOSE 8081 # Command to run the application CMD ["./flaky-service", "--response-behavior-modifier=timestamp", "--behavior-modifier-timestamp-modulus=3"] +USER flaky +HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["/bin/sh", "-c", "wget -q -O /dev/null http://127.0.0.1:8081/metrics"] diff --git a/go/demo/flaky-service/Dockerfile.sidecar b/go/demo/flaky-service/Dockerfile.sidecar index 53dcb68eb8..613f4a30f1 100644 --- a/go/demo/flaky-service/Dockerfile.sidecar +++ b/go/demo/flaky-service/Dockerfile.sidecar @@ -13,3 +13,6 @@ RUN chmod +x ./api_caller.sh # Set the default command to run the shell script with the provided arguments CMD ["./api_caller.sh", "-e", "localhost:8080/api", "-m", "localhost:8081/metrics", "-t", "1.34"] +RUN adduser -D -u 65532 sidecar && chown sidecar:sidecar /api_caller.sh +USER sidecar +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/bin/sh", "-c", "test -x /api_caller.sh"] diff --git a/go/deployment-operator/Dockerfile b/go/deployment-operator/Dockerfile index 985d19d9c6..9046cdb04d 100644 --- a/go/deployment-operator/Dockerfile +++ b/go/deployment-operator/Dockerfile @@ -56,3 +56,4 @@ USER 65532:65532 ENV GOMONTY_FFI_CACHE_DIR=/tmp/gomonty ENTRYPOINT ["/workspace/deployment-agent"] +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/workspace/deployment-agent", "--help"] diff --git a/go/deployment-operator/dockerfiles/agent-harness/claude.Dockerfile b/go/deployment-operator/dockerfiles/agent-harness/claude.Dockerfile index 86d1d27484..ac86270316 100644 --- a/go/deployment-operator/dockerfiles/agent-harness/claude.Dockerfile +++ b/go/deployment-operator/dockerfiles/agent-harness/claude.Dockerfile @@ -42,3 +42,5 @@ RUN claude-agent-acp --version # The entrypoint remains the agent-harness binary # The agent-harness launches claude-agent-acp, which uses the pinned Claude CLI. + +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["claude-agent-acp", "--version"] diff --git a/go/deployment-operator/dockerfiles/agent-harness/codex.Dockerfile b/go/deployment-operator/dockerfiles/agent-harness/codex.Dockerfile index 84003afe1b..ebe99d8770 100644 --- a/go/deployment-operator/dockerfiles/agent-harness/codex.Dockerfile +++ b/go/deployment-operator/dockerfiles/agent-harness/codex.Dockerfile @@ -41,3 +41,5 @@ USER 65532:65532 # The entrypoint remains the agent-harness binary # The agent-harness launches codex-acp directly. + +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["codex-acp", "--version"] diff --git a/go/deployment-operator/dockerfiles/agent-harness/opencode.Dockerfile b/go/deployment-operator/dockerfiles/agent-harness/opencode.Dockerfile index 150687c86e..e20127c75b 100644 --- a/go/deployment-operator/dockerfiles/agent-harness/opencode.Dockerfile +++ b/go/deployment-operator/dockerfiles/agent-harness/opencode.Dockerfile @@ -36,3 +36,5 @@ USER 65532:65532 # The entrypoint remains the agent-harness binary # The agent-harness will call the opencode CLI as needed + +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["opencode", "--version"] diff --git a/go/deployment-operator/dockerfiles/mcpserver/terraform-server/Dockerfile b/go/deployment-operator/dockerfiles/mcpserver/terraform-server/Dockerfile index 789597954b..3430c71a4d 100644 --- a/go/deployment-operator/dockerfiles/mcpserver/terraform-server/Dockerfile +++ b/go/deployment-operator/dockerfiles/mcpserver/terraform-server/Dockerfile @@ -25,7 +25,8 @@ FROM alpine:3.22.1 RUN apk --no-cache add ca-certificates -WORKDIR /root/ +WORKDIR /app +RUN adduser -D -u 65532 mcp WORKDIR /root/WORKDIR /root/ chown mcp:mcp /app # Copy the binary from the builder stage COPY --from=builder /workspace/deployment-operator/terraform-mcpserver . @@ -35,3 +36,5 @@ COPY --from=builder /workspace/deployment-operator/terraform-mcpserver . # Run the MCP server CMD ["./terraform-mcpserver"] +USER mcp +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/app/terraform-mcpserver", "--help"] diff --git a/go/deployment-operator/terratest/go.mod b/go/deployment-operator/terratest/go.mod index cfb5cc1f50..35aee05d80 100644 --- a/go/deployment-operator/terratest/go.mod +++ b/go/deployment-operator/terratest/go.mod @@ -94,7 +94,7 @@ require ( github.com/evanphx/json-patch/v5 v5.9.11 // indirect github.com/fxamacker/cbor/v2 v2.9.0 // indirect github.com/go-errors/errors v1.5.1 // indirect - github.com/go-logr/logr v1.4.3 // indirect + github.com/go-logr/logr v1.4.4 // indirect github.com/go-ole/go-ole v1.3.0 // indirect github.com/go-openapi/jsonpointer v0.22.5 // indirect github.com/go-openapi/jsonreference v0.21.5 // indirect @@ -163,10 +163,10 @@ require ( go.opentelemetry.io/collector/featuregate v1.51.1-0.20260205185216-81bc641f26c0 // indirect go.opentelemetry.io/collector/pdata v1.51.1-0.20260205185216-81bc641f26c0 // indirect go.opentelemetry.io/collector/pdata/pprofile v0.145.1-0.20260205185216-81bc641f26c0 // indirect - go.opentelemetry.io/otel v1.44.0 // indirect - go.opentelemetry.io/otel/metric v1.44.0 // indirect - go.opentelemetry.io/otel/sdk v1.44.0 // indirect - go.opentelemetry.io/otel/trace v1.44.0 // indirect + go.opentelemetry.io/otel v1.45.0 // indirect + go.opentelemetry.io/otel/metric v1.45.0 // indirect + go.opentelemetry.io/otel/sdk v1.45.0 // indirect + go.opentelemetry.io/otel/trace v1.45.0 // indirect go.opentelemetry.io/proto/otlp v1.10.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect diff --git a/go/deployment-operator/terratest/go.sum b/go/deployment-operator/terratest/go.sum index 2fc11e9d13..de64148249 100644 --- a/go/deployment-operator/terratest/go.sum +++ b/go/deployment-operator/terratest/go.sum @@ -169,6 +169,8 @@ github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8b github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ= @@ -422,14 +424,23 @@ go.opentelemetry.io/collector/processor/xprocessor v0.145.0 h1:DaIE7MxRlg0OL1o2P go.opentelemetry.io/collector/processor/xprocessor v0.145.0/go.mod h1:kUwRyKBU/kjCmXodd+0z7CpvcP0A9G9/QL+MaJt4U2o= go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU= +go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ= go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M= +go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s= go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw= +go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA= go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= +go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o= go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= +go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag= +go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc= go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= go.opentelemetry.io/proto/slim/otlp v1.9.0 h1:fPVMv8tP3TrsqlkH1HWYUpbCY9cAIemx184VGkS6vlE= diff --git a/go/helm-test/go.mod b/go/helm-test/go.mod index 166fdd3a76..21fa008738 100644 --- a/go/helm-test/go.mod +++ b/go/helm-test/go.mod @@ -30,7 +30,7 @@ require ( github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect github.com/blang/semver/v4 v4.0.0 // indirect github.com/chai2010/gettext-go v1.0.3 // indirect - github.com/containerd/containerd v1.7.35 // indirect + github.com/containerd/containerd v1.7.36 // indirect github.com/containerd/errdefs v1.0.0 // indirect github.com/containerd/log v0.1.0 // indirect github.com/containerd/platforms v1.0.0-rc.4 // indirect diff --git a/go/kubernetes-agent/api/Dockerfile b/go/kubernetes-agent/api/Dockerfile index 7047f837d0..c7fd7c553d 100644 --- a/go/kubernetes-agent/api/Dockerfile +++ b/go/kubernetes-agent/api/Dockerfile @@ -70,3 +70,4 @@ USER nonroot:nonroot # The port that the application listens on. EXPOSE 8000 8001 ENTRYPOINT ["/dashboard-api", "--insecure-bind-address=0.0.0.0", "--bind-address=0.0.0.0"] +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/dashboard-api", "--help"] diff --git a/go/kubernetes-agent/hack/docker/Dockerfile b/go/kubernetes-agent/hack/docker/Dockerfile index bc9bb0527f..127a7ad56e 100644 --- a/go/kubernetes-agent/hack/docker/Dockerfile +++ b/go/kubernetes-agent/hack/docker/Dockerfile @@ -117,3 +117,5 @@ ENTRYPOINT ["/kas"] # 8154 - Kubernetes API # 8155 - Internal API EXPOSE 8000 8001 8150 8151 8153 8154 8155 +USER nonroot:nonroot +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/kas", "--help"] diff --git a/go/kubernetes-agent/hack/docker/Dockerfile.agentk b/go/kubernetes-agent/hack/docker/Dockerfile.agentk index 179493fc9f..7942e98303 100644 --- a/go/kubernetes-agent/hack/docker/Dockerfile.agentk +++ b/go/kubernetes-agent/hack/docker/Dockerfile.agentk @@ -93,3 +93,5 @@ ENTRYPOINT ["/agentk"] # 8154 - Kubernetes API # 8155 - Internal API # EXPOSE 8000 8001 8150 8151 8153 8154 8155 +USER nonroot:nonroot +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/agentk", "--help"] diff --git a/go/nexus/Dockerfile b/go/nexus/Dockerfile index 1a80d974f9..880a0ee55a 100644 --- a/go/nexus/Dockerfile +++ b/go/nexus/Dockerfile @@ -65,3 +65,4 @@ USER nonroot:nonroot ENTRYPOINT ["/app/nexus"] CMD ["--config", "/app/config/config.yaml"] +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/app/nexus", "--help"] diff --git a/go/observability-proxy/Dockerfile b/go/observability-proxy/Dockerfile index 0295181b73..272707fc6c 100644 --- a/go/observability-proxy/Dockerfile +++ b/go/observability-proxy/Dockerfile @@ -21,3 +21,4 @@ EXPOSE 8080 USER nonroot:nonroot ENTRYPOINT ["/app/observability-proxy"] +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/app/observability-proxy", "--help"] diff --git a/go/oci-auth/Dockerfile b/go/oci-auth/Dockerfile index 897b2bfe03..5eb1f56b0b 100644 --- a/go/oci-auth/Dockerfile +++ b/go/oci-auth/Dockerfile @@ -28,3 +28,4 @@ COPY --from=builder /workspace/oci-auth/oci-auth . USER 65532:65532 ENTRYPOINT ["/oci-auth"] +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/oci-auth", "--help"] diff --git a/go/tools/go.mod b/go/tools/go.mod index 9c0b798289..509f90e8f1 100644 --- a/go/tools/go.mod +++ b/go/tools/go.mod @@ -85,7 +85,7 @@ require ( github.com/ckaznocha/intrange v0.3.1 // indirect github.com/clipperhouse/displaywidth v0.11.0 // indirect github.com/clipperhouse/uax29/v2 v2.7.0 // indirect - github.com/containerd/containerd v1.7.35 // indirect + github.com/containerd/containerd v1.7.36 // indirect github.com/containerd/errdefs v1.0.0 // indirect github.com/containerd/platforms v1.0.0-rc.4 // indirect github.com/curioswitch/go-reassign v0.3.0 // indirect diff --git a/js/console/Dockerfile b/js/console/Dockerfile index 25c70c4fb6..285469c88a 100644 --- a/js/console/Dockerfile +++ b/js/console/Dockerfile @@ -18,3 +18,6 @@ COPY js/design-system/ ./design-system/ WORKDIR /app/console CMD ["yarn", "build"] +RUN chown -R node:node /app +USER node +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["node", "-e", "process.exit(0)"] diff --git a/js/documentation/Dockerfile b/js/documentation/Dockerfile index 36f4ba4ff6..f5c430bc15 100644 --- a/js/documentation/Dockerfile +++ b/js/documentation/Dockerfile @@ -36,3 +36,6 @@ EXPOSE 3000 WORKDIR /app/documentation CMD ["node", "/app/node_modules/next/dist/bin/next", "start", "-p", "3000"] +RUN chown -R node:node /app +USER node +HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 CMD ["node", "-e", "fetch('http://127.0.0.1:3000/').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"] diff --git a/mix.exs b/mix.exs index 5cb341acf3..5a962f30f8 100644 --- a/mix.exs +++ b/mix.exs @@ -63,7 +63,7 @@ defmodule Console.MixProject do github: "elixir-grpc/grpc", sparse: "grpc", ref: "b0d999892cb76e1d7b9bcabb02d22a4e9410fefc"}, - {:gun, "~> 2.4"}, + {:gun, "~> 2.6"}, {:grpc_server, "~> 1.0"}, {:recon, "~> 2.5"}, {:phoenix, "~> 1.5"}, diff --git a/mix.lock b/mix.lock index 2ba6e97ad8..0bbdc264a8 100644 --- a/mix.lock +++ b/mix.lock @@ -75,7 +75,7 @@ "grpc_server": {:hex, :grpc_server, "1.0.4", "25756f17da64589683bb7bcedde3ed3377dfe0daa491f01fbca1c5e8bfa339fd", [:mix], [{:cowboy, "~> 2.14", [hex: :cowboy, repo: "hexpm", optional: false]}, {:cowlib, "~> 2.14", [hex: :cowlib, repo: "hexpm", optional: false]}, {:flow, "~> 1.2", [hex: :flow, repo: "hexpm", optional: false]}, {:grpc_core, "~> 1.0.4", [hex: :grpc_core, repo: "hexpm", optional: false]}, {:protobuf, "~> 0.17", [hex: :protobuf, repo: "hexpm", optional: false]}], "hexpm", "f3ceaf59d5661f52429ccf360ad5f0e866ef7a09adc6888c1b57ba0791457885"}, "grpcbox": {:hex, :grpcbox, "0.18.0", "ccc14ec546509e0952d406ef626c5856b68d36a40be6040fa444b375b33bd14f", [:rebar3], [{:acceptor_pool, "~> 1.0.0", [hex: :acceptor_pool, repo: "hexpm", optional: false]}, {:chatterbox, "~> 0.16.0", [hex: :ts_chatterbox, repo: "hexpm", optional: false]}, {:ctx, "~> 0.6.0", [hex: :ctx, repo: "hexpm", optional: false]}, {:gproc, "~> 1.2.0", [hex: :gproc, repo: "hexpm", optional: false]}], "hexpm", "5ec9f8fe664ab51201b32c117a61511a1f9d6316771e3891ba8a88d289a732ab"}, "guardian": {:hex, :guardian, "2.4.0", "efbbb397ecca881bb548560169922fc4433a05bc98c2eb96a7ed88ede9e17d64", [:mix], [{:jose, "~> 1.11.9", [hex: :jose, repo: "hexpm", optional: false]}, {:plug, "~> 1.3.3 or ~> 1.4", [hex: :plug, repo: "hexpm", optional: true]}], "hexpm", "5c80103a9c538fbc2505bf08421a82e8f815deba9eaedb6e734c66443154c518"}, - "gun": {:hex, :gun, "2.4.1", "c3a8bff8e155e1fc8e499216599bb7effbd27bc1985662a8b25016090dc18428", [:make, :rebar3], [{:cowlib, ">= 2.15.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "1450575b4d393aa0811322727b90ad1dd94b5c10026f54a1641785bcbd250384"}, + "gun": {:hex, :gun, "2.6.0", "4672fe3d2e056d9314a4639db288b7e9ce0fe6be8f2f4dd4adba7d2b56f7927c", [:make, :rebar3], [{:cowlib, ">= 2.20.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "69bb957f4bd6c475b5714460fd65c26fc7eb85760aa64b74754de36ce5cced7d"}, "h2": {:hex, :h2, "0.12.0", "f393539ee2728f8118fb2024b6d5f3e2c45e40ceb31b18b4e9bf5e50d028f80f", [:rebar3], [], "hexpm", "beaafc93c54cdc5d623247334d3970cdf4bc66b6b8b296b74ba1d7c7513c3dfc"}, "hackney": {:hex, :hackney, "4.7.4", "8fe2ddaa3ca27de99d68e682d72b66d07d2331da680f77c8000580a0122c69e6", [:rebar3], [{:certifi, "~> 2.17.0", [hex: :certifi, repo: "hexpm", optional: false]}, {:h2, "~> 0.12.0", [hex: :h2, repo: "hexpm", optional: false]}, {:idna, "~> 7.1.0", [hex: :idna, repo: "hexpm", optional: false]}, {:mimerl, "~> 1.5", [hex: :mimerl, repo: "hexpm", optional: false]}, {:parse_trans, "3.4.2", [hex: :parse_trans, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "~> 1.1.0", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}, {:webtransport, "~> 0.4.5", [hex: :webtransport, repo: "hexpm", optional: false]}], "hexpm", "d07d7e1358353ab6cc75132f058c155287f3e013d43f709fbb79d79eeab98195"}, "ham": {:hex, :ham, "0.3.0", "7cd031b4a55fba219c11553e7b13ba73bd86eab4034518445eff1e038cb9a44d", [:mix], [], "hexpm", "7d6c6b73d7a6a83233876cc1b06a4d9b5de05562b228effda4532f9a49852bf6"}, diff --git a/repository-prebake/base/Dockerfile b/repository-prebake/base/Dockerfile index e989da5244..c79043881e 100644 --- a/repository-prebake/base/Dockerfile +++ b/repository-prebake/base/Dockerfile @@ -79,3 +79,7 @@ RUN set -eux; \ COPY --from=cli /prebake /usr/local/bin/prebake COPY --from=fcp /opt/fcp/bin/fcp /usr/local/bin/fcp WORKDIR /data + +RUN chown -R 65532:65532 /data +USER 65532:65532 +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/usr/local/bin/prebake", "--help"] diff --git a/repository-prebake/console/Dockerfile b/repository-prebake/console/Dockerfile index 5d1f9ad955..b2b1e9c912 100644 --- a/repository-prebake/console/Dockerfile +++ b/repository-prebake/console/Dockerfile @@ -9,7 +9,7 @@ # --secret id=git_token,env=GIT_ACCESS_TOKEN \ # -t docker.io/pluralsh/console-repos:local . -ARG PREBAKE_IMAGE=docker.io/pluralsh/repository-prebake:latest +ARG PREBAKE_IMAGE=docker.io/pluralsh/repository-prebake:v0.1.0 FROM ${PREBAKE_IMAGE} @@ -31,3 +31,4 @@ RUN --mount=type=secret,id=git_token,required=false \ && chown -R 65532:65532 /data USER 65532 +HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/usr/local/bin/prebake", "--help"] diff --git a/rust/embedding-server/Dockerfile b/rust/embedding-server/Dockerfile index 70dc2f0921..de782db311 100644 --- a/rust/embedding-server/Dockerfile +++ b/rust/embedding-server/Dockerfile @@ -56,3 +56,7 @@ EXPOSE 80 # The upstream image provides the text-embeddings-router entrypoint and its # default --json-output argument. MODEL_ID and SERVED_MODEL_NAME are supplied # through the environment so this wrapper does not replace that entrypoint. + +# TEI's upstream image provides an unprivileged runtime user; retain model read access. +USER 1000 +HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 CMD ["/usr/local/bin/text-embeddings-router", "--help"] From 617b7272af7e99f886e60f72d841af2aee52eeb3 Mon Sep 17 00:00:00 2001 From: Michael Guarino Date: Sun, 27 Sep 2026 00:18:27 +0000 Subject: [PATCH 2/6] fix(mix): restore compatible Gun constraint for grpc --- mix.exs | 2 +- mix.lock | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/mix.exs b/mix.exs index 5a962f30f8..5cb341acf3 100644 --- a/mix.exs +++ b/mix.exs @@ -63,7 +63,7 @@ defmodule Console.MixProject do github: "elixir-grpc/grpc", sparse: "grpc", ref: "b0d999892cb76e1d7b9bcabb02d22a4e9410fefc"}, - {:gun, "~> 2.6"}, + {:gun, "~> 2.4"}, {:grpc_server, "~> 1.0"}, {:recon, "~> 2.5"}, {:phoenix, "~> 1.5"}, diff --git a/mix.lock b/mix.lock index 0bbdc264a8..2ba6e97ad8 100644 --- a/mix.lock +++ b/mix.lock @@ -75,7 +75,7 @@ "grpc_server": {:hex, :grpc_server, "1.0.4", "25756f17da64589683bb7bcedde3ed3377dfe0daa491f01fbca1c5e8bfa339fd", [:mix], [{:cowboy, "~> 2.14", [hex: :cowboy, repo: "hexpm", optional: false]}, {:cowlib, "~> 2.14", [hex: :cowlib, repo: "hexpm", optional: false]}, {:flow, "~> 1.2", [hex: :flow, repo: "hexpm", optional: false]}, {:grpc_core, "~> 1.0.4", [hex: :grpc_core, repo: "hexpm", optional: false]}, {:protobuf, "~> 0.17", [hex: :protobuf, repo: "hexpm", optional: false]}], "hexpm", "f3ceaf59d5661f52429ccf360ad5f0e866ef7a09adc6888c1b57ba0791457885"}, "grpcbox": {:hex, :grpcbox, "0.18.0", "ccc14ec546509e0952d406ef626c5856b68d36a40be6040fa444b375b33bd14f", [:rebar3], [{:acceptor_pool, "~> 1.0.0", [hex: :acceptor_pool, repo: "hexpm", optional: false]}, {:chatterbox, "~> 0.16.0", [hex: :ts_chatterbox, repo: "hexpm", optional: false]}, {:ctx, "~> 0.6.0", [hex: :ctx, repo: "hexpm", optional: false]}, {:gproc, "~> 1.2.0", [hex: :gproc, repo: "hexpm", optional: false]}], "hexpm", "5ec9f8fe664ab51201b32c117a61511a1f9d6316771e3891ba8a88d289a732ab"}, "guardian": {:hex, :guardian, "2.4.0", "efbbb397ecca881bb548560169922fc4433a05bc98c2eb96a7ed88ede9e17d64", [:mix], [{:jose, "~> 1.11.9", [hex: :jose, repo: "hexpm", optional: false]}, {:plug, "~> 1.3.3 or ~> 1.4", [hex: :plug, repo: "hexpm", optional: true]}], "hexpm", "5c80103a9c538fbc2505bf08421a82e8f815deba9eaedb6e734c66443154c518"}, - "gun": {:hex, :gun, "2.6.0", "4672fe3d2e056d9314a4639db288b7e9ce0fe6be8f2f4dd4adba7d2b56f7927c", [:make, :rebar3], [{:cowlib, ">= 2.20.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "69bb957f4bd6c475b5714460fd65c26fc7eb85760aa64b74754de36ce5cced7d"}, + "gun": {:hex, :gun, "2.4.1", "c3a8bff8e155e1fc8e499216599bb7effbd27bc1985662a8b25016090dc18428", [:make, :rebar3], [{:cowlib, ">= 2.15.0 and < 3.0.0", [hex: :cowlib, repo: "hexpm", optional: false]}], "hexpm", "1450575b4d393aa0811322727b90ad1dd94b5c10026f54a1641785bcbd250384"}, "h2": {:hex, :h2, "0.12.0", "f393539ee2728f8118fb2024b6d5f3e2c45e40ceb31b18b4e9bf5e50d028f80f", [:rebar3], [], "hexpm", "beaafc93c54cdc5d623247334d3970cdf4bc66b6b8b296b74ba1d7c7513c3dfc"}, "hackney": {:hex, :hackney, "4.7.4", "8fe2ddaa3ca27de99d68e682d72b66d07d2331da680f77c8000580a0122c69e6", [:rebar3], [{:certifi, "~> 2.17.0", [hex: :certifi, repo: "hexpm", optional: false]}, {:h2, "~> 0.12.0", [hex: :h2, repo: "hexpm", optional: false]}, {:idna, "~> 7.1.0", [hex: :idna, repo: "hexpm", optional: false]}, {:mimerl, "~> 1.5", [hex: :mimerl, repo: "hexpm", optional: false]}, {:parse_trans, "3.4.2", [hex: :parse_trans, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "~> 1.1.0", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}, {:webtransport, "~> 0.4.5", [hex: :webtransport, repo: "hexpm", optional: false]}], "hexpm", "d07d7e1358353ab6cc75132f058c155287f3e013d43f709fbb79d79eeab98195"}, "ham": {:hex, :ham, "0.3.0", "7cd031b4a55fba219c11553e7b13ba73bd86eab4034518445eff1e038cb9a44d", [:mix], [], "hexpm", "7d6c6b73d7a6a83233876cc1b06a4d9b5de05562b228effda4532f9a49852bf6"}, From 65718503780aa5bffec3d09a94d3c5c66a47332c Mon Sep 17 00:00:00 2001 From: Michael Guarino Date: Sun, 27 Sep 2026 00:21:09 +0000 Subject: [PATCH 3/6] fix(docker): repair hardened image build paths and probes --- dockerfiles/Dockerfile.test | 2 +- go/cloud-query/Dockerfile | 6 ++-- .../mcpserver/terraform-server/Dockerfile | 2 +- go/helm-test/go.sum | 10 ++++--- go/tools/go.sum | 30 ++++++++++--------- repository-prebake/console/Dockerfile | 3 +- 6 files changed, 30 insertions(+), 23 deletions(-) diff --git a/dockerfiles/Dockerfile.test b/dockerfiles/Dockerfile.test index a9b2f305f3..491684115b 100644 --- a/dockerfiles/Dockerfile.test +++ b/dockerfiles/Dockerfile.test @@ -24,6 +24,6 @@ RUN if [ "$OS_VARIANT" = "alpine" ]; then \ if [ "$OS_VARIANT" != "alpine" ]; then rustc --version && cargo --version; fi && \ mix local.rebar --force && \ mix local.hex --force -RUN addgroup -S app && adduser -S -G app app && chown -R app:app /app /usr/local/cargo /usr/local/rustup +RUN if [ "$OS_VARIANT" = "alpine" ]; then addgroup -S app && adduser -S -G app app; else groupadd --system app && useradd --system --gid app app; fi && mkdir -p /usr/local/cargo /usr/local/rustup && chown -R app:app /app /usr/local/cargo /usr/local/rustup USER app HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["mix", "--version"] diff --git a/go/cloud-query/Dockerfile b/go/cloud-query/Dockerfile index 40f418dac0..2404705279 100644 --- a/go/cloud-query/Dockerfile +++ b/go/cloud-query/Dockerfile @@ -42,5 +42,7 @@ COPY --from=builder /workspace/bin/cloud-query /usr/local/bin/cloud-query USER nonroot -CMD ["/usr/local/bin/cloud-query"]EXPOSE 8080 -HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["/usr/local/bin/cloud-query", "--help"] +EXPOSE 8080 +RUN apk add --no-cache curl +CMD ["/usr/local/bin/cloud-query"] +HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["curl", "--fail", "--silent", "http://127.0.0.1:8080/healthz"] diff --git a/go/deployment-operator/dockerfiles/mcpserver/terraform-server/Dockerfile b/go/deployment-operator/dockerfiles/mcpserver/terraform-server/Dockerfile index 3430c71a4d..5b5d7ebdc2 100644 --- a/go/deployment-operator/dockerfiles/mcpserver/terraform-server/Dockerfile +++ b/go/deployment-operator/dockerfiles/mcpserver/terraform-server/Dockerfile @@ -26,7 +26,7 @@ FROM alpine:3.22.1 RUN apk --no-cache add ca-certificates WORKDIR /app -RUN adduser -D -u 65532 mcp WORKDIR /root/WORKDIR /root/ chown mcp:mcp /app +RUN adduser -D -u 65532 mcp && chown mcp:mcp /app # Copy the binary from the builder stage COPY --from=builder /workspace/deployment-operator/terraform-mcpserver . diff --git a/go/helm-test/go.sum b/go/helm-test/go.sum index 06ce7ec739..3ceef06ed9 100644 --- a/go/helm-test/go.sum +++ b/go/helm-test/go.sum @@ -37,6 +37,8 @@ github.com/chai2010/gettext-go v1.0.3 h1:9liNh8t+u26xl5ddmWLmsOsdNLwkdRTg5AG+JnT github.com/chai2010/gettext-go v1.0.3/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA= github.com/containerd/containerd v1.7.35 h1:7AU2T1qI2OdNBmKkreWZ7kASHUNFItN5Hgejd9sY938= github.com/containerd/containerd v1.7.35/go.mod h1:ozI//0TomTCLPhQREnx0IXDIQMg+Fk7yTtg9fNvU8EQ= +github.com/containerd/containerd v1.7.36 h1:HyMsOG5kmp1LQsGzqwI6Ts06T4VpYZbszfDZYB0bW5w= +github.com/containerd/containerd v1.7.36/go.mod h1:ozI//0TomTCLPhQREnx0IXDIQMg+Fk7yTtg9fNvU8EQ= github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M= github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I= @@ -285,18 +287,18 @@ github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY= github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo= github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= -github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY= github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk= github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA= @@ -374,9 +376,9 @@ golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= diff --git a/go/tools/go.sum b/go/tools/go.sum index 382271bea7..b08ade7248 100644 --- a/go/tools/go.sum +++ b/go/tools/go.sum @@ -152,6 +152,8 @@ github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9 github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg= github.com/containerd/containerd v1.7.35 h1:7AU2T1qI2OdNBmKkreWZ7kASHUNFItN5Hgejd9sY938= github.com/containerd/containerd v1.7.35/go.mod h1:ozI//0TomTCLPhQREnx0IXDIQMg+Fk7yTtg9fNvU8EQ= +github.com/containerd/containerd v1.7.36 h1:HyMsOG5kmp1LQsGzqwI6Ts06T4VpYZbszfDZYB0bW5w= +github.com/containerd/containerd v1.7.36/go.mod h1:ozI//0TomTCLPhQREnx0IXDIQMg+Fk7yTtg9fNvU8EQ= github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M= github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I= @@ -413,9 +415,9 @@ github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ= github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY= github.com/karamaru-alpha/copyloopvar v1.2.2 h1:yfNQvP9YaGQR7VaWLYcfZUlRP2eo2vhExWKxD/fP6q0= github.com/karamaru-alpha/copyloopvar v1.2.2/go.mod h1:oY4rGZqZ879JkJMtX3RRkcXRkmUvH0x35ykgaKgsgJY= -github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/errcheck v1.20.0 h1:9rwHBNKzd4wkDWcROy3DvFGNqEPlkxBg305rvk7HabI= github.com/kisielk/errcheck v1.20.0/go.mod h1:O+f80MKNwX8Oor2jwgpeQ9An7uJm+hRSgT+h22knRJU= +github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/kkHAIKE/contextcheck v1.1.6 h1:7HIyRcnyzxL9Lz06NGhiKvenXq7Zw6Q0UQu/ttjfJCE= github.com/kkHAIKE/contextcheck v1.1.6/go.mod h1:3dDbMRNBFaq8HFXWC1JyvDSPm43CmE6IuHam8Wr0rkg= @@ -535,9 +537,9 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= -github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw= github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU= github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w= +github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw= github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE= github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs= github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo= @@ -624,10 +626,10 @@ github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY= github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo= github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= -github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU= github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY= github.com/ssgreg/nlreturn/v2 v2.2.1 h1:X4XDI7jstt3ySqGU86YGAURbxw3oTDPK9sPEi6YEwQ0= @@ -639,14 +641,14 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= -github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= -github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8= github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU= github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA= @@ -763,11 +765,11 @@ golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f/go.mod h1:PqrXSW6 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= +golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= -golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= @@ -776,9 +778,9 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= -golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -803,26 +805,26 @@ golang.org/x/sys v0.0.0-20211105183446-c75c47738b0c/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5 h1:ZUSxONxc981v7AW7QUg+I9WwZzSTTJ019ENBYr5pV/Q= golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5/go.mod h1:LVehoXe41cL5SCVQilsV7Gg6BNG+Js6P9PhSbYTIUkQ= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -835,9 +837,9 @@ golang.org/x/tools v0.1.1-0.20210205202024-ef80cdb6ec6d/go.mod h1:9bzcO0MWcOuT0t golang.org/x/tools v0.1.1-0.20210302220138-2ac05c832e1a/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU= golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= -golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= +golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM= golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM= diff --git a/repository-prebake/console/Dockerfile b/repository-prebake/console/Dockerfile index b2b1e9c912..7dddac10a3 100644 --- a/repository-prebake/console/Dockerfile +++ b/repository-prebake/console/Dockerfile @@ -9,9 +9,10 @@ # --secret id=git_token,env=GIT_ACCESS_TOKEN \ # -t docker.io/pluralsh/console-repos:local . -ARG PREBAKE_IMAGE=docker.io/pluralsh/repository-prebake:v0.1.0 +ARG PREBAKE_IMAGE=docker.io/pluralsh/repository-prebake:2026-09-27 FROM ${PREBAKE_IMAGE} +USER root ENV LANG=C.UTF-8 \ LC_ALL=C.UTF-8 \ From dbb0b3939b0f74b5009bebd93b589c3d970a15de Mon Sep 17 00:00:00 2001 From: Michael Guarino Date: Sun, 27 Sep 2026 00:32:03 +0000 Subject: [PATCH 4/6] fix(cloud-query): install health probe as root --- go/cloud-query/Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/go/cloud-query/Dockerfile b/go/cloud-query/Dockerfile index 2404705279..a447be0a64 100644 --- a/go/cloud-query/Dockerfile +++ b/go/cloud-query/Dockerfile @@ -40,9 +40,10 @@ LABEL org.opencontainers.image.created="${BUILD_TIME}" \ # Copy cloud-query and steampipe extensions COPY --from=builder /workspace/bin/cloud-query /usr/local/bin/cloud-query -USER nonroot +USER root EXPOSE 8080 RUN apk add --no-cache curl +USER nonroot CMD ["/usr/local/bin/cloud-query"] HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["curl", "--fail", "--silent", "http://127.0.0.1:8080/healthz"] From d2a642d47800a016e2d29709d32b1ea7c5865826 Mon Sep 17 00:00:00 2001 From: Michael Guarino Date: Sun, 27 Sep 2026 00:33:54 +0000 Subject: [PATCH 5/6] fix(security): correct runtime health checks --- dockerfiles/Dockerfile.test | 1 - go/cloud-query/Dockerfile | 2 +- go/demo/flaky-service/Dockerfile.sidecar | 1 - js/console/Dockerfile | 1 - repository-prebake/base/Dockerfile | 1 - repository-prebake/console/Dockerfile | 1 - 6 files changed, 1 insertion(+), 6 deletions(-) diff --git a/dockerfiles/Dockerfile.test b/dockerfiles/Dockerfile.test index 491684115b..26803573d0 100644 --- a/dockerfiles/Dockerfile.test +++ b/dockerfiles/Dockerfile.test @@ -26,4 +26,3 @@ RUN if [ "$OS_VARIANT" = "alpine" ]; then \ mix local.hex --force RUN if [ "$OS_VARIANT" = "alpine" ]; then addgroup -S app && adduser -S -G app app; else groupadd --system app && useradd --system --gid app app; fi && mkdir -p /usr/local/cargo /usr/local/rustup && chown -R app:app /app /usr/local/cargo /usr/local/rustup USER app -HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["mix", "--version"] diff --git a/go/cloud-query/Dockerfile b/go/cloud-query/Dockerfile index a447be0a64..45c31bdf32 100644 --- a/go/cloud-query/Dockerfile +++ b/go/cloud-query/Dockerfile @@ -46,4 +46,4 @@ EXPOSE 8080 RUN apk add --no-cache curl USER nonroot CMD ["/usr/local/bin/cloud-query"] -HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["curl", "--fail", "--silent", "http://127.0.0.1:8080/healthz"] +HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["curl", "--fail", "--silent", "--show-error", "http://127.0.0.1:8080/healthz"] diff --git a/go/demo/flaky-service/Dockerfile.sidecar b/go/demo/flaky-service/Dockerfile.sidecar index 613f4a30f1..bee312113c 100644 --- a/go/demo/flaky-service/Dockerfile.sidecar +++ b/go/demo/flaky-service/Dockerfile.sidecar @@ -15,4 +15,3 @@ CMD ["./api_caller.sh", "-e", "localhost:8080/api", "-m", "localhost:8081/metric RUN adduser -D -u 65532 sidecar && chown sidecar:sidecar /api_caller.sh USER sidecar -HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/bin/sh", "-c", "test -x /api_caller.sh"] diff --git a/js/console/Dockerfile b/js/console/Dockerfile index 285469c88a..4d7e3f5499 100644 --- a/js/console/Dockerfile +++ b/js/console/Dockerfile @@ -20,4 +20,3 @@ WORKDIR /app/console CMD ["yarn", "build"] RUN chown -R node:node /app USER node -HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["node", "-e", "process.exit(0)"] diff --git a/repository-prebake/base/Dockerfile b/repository-prebake/base/Dockerfile index c79043881e..f0c87e9053 100644 --- a/repository-prebake/base/Dockerfile +++ b/repository-prebake/base/Dockerfile @@ -82,4 +82,3 @@ WORKDIR /data RUN chown -R 65532:65532 /data USER 65532:65532 -HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/usr/local/bin/prebake", "--help"] diff --git a/repository-prebake/console/Dockerfile b/repository-prebake/console/Dockerfile index 7dddac10a3..dd1b015866 100644 --- a/repository-prebake/console/Dockerfile +++ b/repository-prebake/console/Dockerfile @@ -32,4 +32,3 @@ RUN --mount=type=secret,id=git_token,required=false \ && chown -R 65532:65532 /data USER 65532 -HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD ["/usr/local/bin/prebake", "--help"] From 8284c7bd6a06caf8a94df8d73429cf617dfc2391 Mon Sep 17 00:00:00 2001 From: Michael Guarino Date: Sun, 27 Sep 2026 00:36:48 +0000 Subject: [PATCH 6/6] fix(docker): preserve writable test bind mounts --- dockerfiles/Dockerfile.test | 2 -- 1 file changed, 2 deletions(-) diff --git a/dockerfiles/Dockerfile.test b/dockerfiles/Dockerfile.test index 26803573d0..a189b162a7 100644 --- a/dockerfiles/Dockerfile.test +++ b/dockerfiles/Dockerfile.test @@ -24,5 +24,3 @@ RUN if [ "$OS_VARIANT" = "alpine" ]; then \ if [ "$OS_VARIANT" != "alpine" ]; then rustc --version && cargo --version; fi && \ mix local.rebar --force && \ mix local.hex --force -RUN if [ "$OS_VARIANT" = "alpine" ]; then addgroup -S app && adduser -S -G app app; else groupadd --system app && useradd --system --gid app app; fi && mkdir -p /usr/local/cargo /usr/local/rustup && chown -R app:app /app /usr/local/cargo /usr/local/rustup -USER app