-
-
Notifications
You must be signed in to change notification settings - Fork 153
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security] libraries with CVEs that are not used by the project #298
Comments
argh i screwed up testing, creating a new issue |
Investigating in #341 |
It was a regression in Rust, closing this issue out since distroless images are indeed being used now. |
What happened?
A container should be as small as possible with only the necessary libraries to run, so I would like to warn against using a base image such as debian which has a set of libraries that may be necessary for those who use it but which have security flaws already listed in docker.
https://hub.docker.com/layers/library/debian/bullseye-slim/images/sha256-9af4db29e828a4d08c7819f9e0972e2dbdac575e73c6438630c83bd79f49c8aa?context=repo&tab=vulnerabilities
As these libraries are not used by revolt, I implemented distrolless which has other advantages such as being lighter but the main one is security so I strongly recommend using it follow the link to the PR.
#297
The text was updated successfully, but these errors were encountered: