postgres-operator
postgres-operator copied to clipboard
zalando
bumped to alpine base image 3.15
Hello,
our SNYK security scan has found, that the Zalando Postgres Operator image is vulnerable to the following security issue which comes by using the Alpine 3.12 base image. It should be fixed in Alpine 3.13. I would like to ask you to update the used base image of the Zalando Operator and release a new version.
https://www.cve.org/CVERecord?id=CVE-2022-37434
Lets go straight to 3.15. This is also what we use for the pooler. Can you raise the version in all Docker files of the project that use it (debug and UI)?
Lets go straight to 3.15. This is also what we use for the pooler. Can you raise the version in all Docker files of the project that use it (debug and UI)?
@FxKu,
I've done so. Hope I haven't missed a Dockerfile.
Kind regards Philip
@FxKu @thedatabaseme - can we bump the base image to 3.16
@pgvishnuram @FxKu This has to be approved by the maintainers anyway. Just tell me what you wish for.
@thedatabaseme - I see zolando team already have registry.opensource.zalan.do/v2/library/alpine-3.16 in their registry - I wish to keep it latest
I tried to raise it to 3.16 for our pooler, but it doesn't work yet. So let's go with 3.15 for now. Any important features we miss out with 3.16 @pgvishnuram ?
