Skip to content

Commit 371a3ea

Browse files
sanzmaurosanzmauro
authored
Merge pull request #45 from splitio/docker-security
Docker security upgrades
2 parents 919116a + c56e217 commit 371a3ea

4 files changed

Lines changed: 41 additions & 34 deletions

File tree

‎CHANGES‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
1-
1.6.0 (Feb 4, 2025)
2-
- Added Health & Readiness endpoints
1+
1.6.0 (Feb 5, 2025)
2+
- Added Health & Readiness endpoints.
3+
- Fixing vulnerabilities.
34

45
1.5.0 (Jan 29, 2025):
56
- Added support for the new impressions tracking toggle available on feature flags, both respecting the setting and including the new field being returned on SplitView type objects. Read more in our docs.

‎go.mod‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
module github.com/splitio/splitd
22

3-
go 1.21
3+
go 1.23.6
44

55
require (
66
github.com/gin-gonic/gin v1.10.0
7-
github.com/go-playground/assert/v2 v2.2.0
87
github.com/splitio/go-split-commons/v6 v6.1.0
98
github.com/splitio/go-toolkit/v5 v5.4.0
109
github.com/stretchr/testify v1.9.0
1110
github.com/vmihailenco/msgpack/v5 v5.3.5
12-
golang.org/x/sync v0.3.0
11+
golang.org/x/sync v0.10.0
1312
gopkg.in/yaml.v3 v3.0.1
1413
)
1514

@@ -40,10 +39,10 @@ require (
4039
github.com/ugorji/go/codec v1.2.12 // indirect
4140
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
4241
golang.org/x/arch v0.8.0 // indirect
43-
golang.org/x/crypto v0.23.0 // indirect
42+
golang.org/x/crypto v0.32.0 // indirect
4443
golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
45-
golang.org/x/net v0.25.0 // indirect
46-
golang.org/x/sys v0.20.0 // indirect
47-
golang.org/x/text v0.15.0 // indirect
44+
golang.org/x/net v0.34.0 // indirect
45+
golang.org/x/sys v0.29.0 // indirect
46+
golang.org/x/text v0.21.0 // indirect
4847
google.golang.org/protobuf v1.34.1 // indirect
4948
)

‎go.sum‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -82,20 +82,20 @@ github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV
8282
golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
8383
golang.org/x/arch v0.8.0 h1:3wRIsP3pM4yUptoR96otTUOXI367OS0+c9eeRi9doIc=
8484
golang.org/x/arch v0.8.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
85-
golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
86-
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
85+
golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
86+
golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
8787
golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
8888
golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
89-
golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
90-
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
91-
golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
92-
golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
89+
golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
90+
golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
91+
golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
92+
golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
9393
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
9494
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
95-
golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
96-
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
97-
golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
98-
golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
95+
golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
96+
golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
97+
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
98+
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
9999
google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg=
100100
google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
101101
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

‎infra/sidecar.Dockerfile‎

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,42 @@
11
# ----- Builder image
2-
FROM golang:1.21.6-bookworm AS builder
2+
ARG GOLANG_VERSION=1.23.6
3+
FROM golang:${GOLANG_VERSION}-bookworm AS builder
34

45
ARG FIPS_MODE
56
ARG COMMIT_SHA
67

7-
RUN apt update -y
8-
RUN apt install -y build-essential ca-certificates python3 git socat
8+
RUN DEBIAN_FRONTEND=noninteractive \
9+
apt-get update && \
10+
apt-get install --no-install-recommends -y \
11+
build-essential ca-certificates python3 git socat
912

1013
WORKDIR /splitd
1114
COPY . .
1215

1316
RUN export GITHUB_SHA="${COMMIT_SHA}" && bash -c '\
14-
if [[ "${FIPS_MODE}" = "enabled" ]]; \
15-
then echo "building in fips mode"; make clean splitd-fips splitd.yaml.tpl EXTRA_BUILD_ARGS="${EXTRA_BUILD_ARGS}"; mv splitd-fips splitd; \
16-
else echo "building in standard mode"; make clean splitd splitd.yaml.tpl EXTRA_BUILD_ARGS="${EXTRA_BUILD_ARGS}"; \
17-
fi'
17+
if [[ "${FIPS_MODE}" = "enabled" ]]; \
18+
then echo "building in fips mode"; make clean splitd-fips splitd.yaml.tpl EXTRA_BUILD_ARGS="${EXTRA_BUILD_ARGS}"; mv splitd-fips splitd; \
19+
else echo "building in standard mode"; make clean splitd splitd.yaml.tpl EXTRA_BUILD_ARGS="${EXTRA_BUILD_ARGS}"; \
20+
fi'
1821

1922
# ----- Runner image
20-
FROM debian:12.4 AS runner
23+
FROM debian:bookworm-20250203-slim AS runner
2124

22-
RUN apt update -y
23-
RUN apt install -y bash ca-certificates wget socat
25+
ARG YQ_VERSION=v4.44.6
2426

25-
RUN wget https://github.com/mikefarah/yq/releases/download/v4.40.5/yq_linux_amd64
26-
RUN chmod +x yq_linux_amd64
27-
RUN mv yq_linux_amd64 /usr/local/bin/yq
27+
RUN DEBIAN_FRONTEND=noninteractive \
28+
apt-get update && \
29+
apt-get install --no-install-recommends -y \
30+
bash ca-certificates wget socat && \
31+
wget -O /usr/local/bin/yq \
32+
"https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" && \
33+
chmod +x /usr/local/bin/yq && \
34+
mkdir -p /opt/splitd && \
35+
rm -rf /var/lib/apt/lists/*
2836

29-
RUN mkdir -p /opt/splitd
3037
COPY --from=builder /splitd/splitd /opt/splitd
3138
COPY --from=builder /splitd/splitd.yaml.tpl /opt/splitd
3239
COPY infra/entrypoint.sh /opt/splitd
3340
RUN chmod +x /opt/splitd/entrypoint.sh
3441

35-
ENTRYPOINT ["/opt/splitd/entrypoint.sh"]
42+
ENTRYPOINT ["/opt/splitd/entrypoint.sh"]

0 commit comments

Comments
 (0)