keripy
keripy copied to clipboard
Security issues in docker images
When we run a scan with trivy
on the images:
- gleif/did-webs-resolver-service:latest
- gleif/did-keri-resolver-service:latest
we get a long list of security issues mostly related to alpine 3.16.0
and a few for python-pkg
.
The issues with alpine could be fixed by upgrading to alpine 3.18
and it seems this is done already here but somehow these change is not reflected in the images above.
This is because the base image gleif/keri:latest
hasn't been updated in 7 months:
https://hub.docker.com/r/gleif/keri/tags
Yes, the Docker Hub image just needs to be updated. Until we get this coming out of a CI pipeline then someone who has access to the glief/keri
Docker Hub repo will need to manually push a new image.