Repository navigation
fix(docker): reduce Docker Scout CVEs with slim stable Nginx base - #295
Open
ThisIs-Developer wants to merge 4 commits into
Open
ThisIs-Developer wants to merge 4 commits into
ThisIs-Developer wants to merge 4 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Deploying markdownviewer with
|
| Latest commit: |
87730b2
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://95e6de65.markdownviewer.pages.dev |
| Branch Preview URL: | https://fix-docker-scout-security-20.markdownviewer.pages.dev |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes
nginx:1.31.8-alpine3.24-slimruntime in place ofnginx:alpine, removing optional package dependencies that contributed to Docker Scout findings.apk upgrade --no-cache(do not install edge packages).--pull, add a real HTTP container smoke test and Nginx config check, upload full Trivy JSON findings, and fail CI for fixable Critical/High issues.HTTP-only: Keeps port 80 inside the image and
http://localhost:8080for the user's existingdocker run -p 8080:80command. Does not add HTTPS, certificates, Caddy, or additional Compose files.Maintainer Docker Scout ZIP independently inspected (2026-11-15)
The maintainer's full locally exported Docker Scout ZIP was inspected (SARIF + SPDX SBOM + Scout policy summary + recommendations). This is actual baseline evidence, not a count inferred from a screenshot:
ghcr.io/thisis-developer/markdown-viewer:latest,linux/amd64, image IDsha256:3aaa210b4cc8093feaef203bf2591a56eb9b6072133d763acfd4a116ba3d7168, scan at 2026-11-15 17:52 IST, Docker Scout v1.28.0.zlib 1.3.2-r1(1 Critical),libxslt 1.1.43-r3(3 High/1 Medium),libxml2 2.13.9-r2(1 High/5 Medium/5 Low),musl 1.2.6-r3(1 High), andopenssl 3.5.9-r0(5 Unspecified). Eleven findings are marked with advisory fix versions; elevenlibxml2findings saynot fixed.sha256:24af787445861cc33dd49800b6ca361b32ece54f290df05dcc5e7e6e66b9d2f2(Alpine 3.24.4), with zero Trivy findings. Its inventory haszlib 1.4-r0, nolibxml2orlibxsltpackage,musl 1.2.6-r3, andlibcrypto3/libssl3 3.5.9-r0still present.1.2.6-r3as fixed, contrasting with Scout's cross-branch1.2.6-r6suggestion; Alpine v3.24 OpenSSL is still3.5.9-r0. Don't mix Alpine edge packages into stable, and don't suppress the outstanding OpenSSL results.Follow-up: The exact PR #295 Docker Scout SARIF scan has now been performed and compared below. The separate
docker scout policytext export did not complete correctly because the Windows PowerShell collector captured a Docker Scout version notice on stderr as an exception; its policy grade has not been established. The present PR does not touch productionlatestunless merged and published.Independent PR #295 Docker Scout regression scan (2026-11-15, 18:55–18:58 IST)
The maintainer ran
Test-MarkdownViewer-PR295-DockerScout.ps1againstfix/docker-scout-security-20261115and supplied the resulting 9-file verification ZIP. I independently parsed the two actual Scout SARIF reports and the new image inspect/HTTP probes.latest3aaa210b4cc896abf6712ea1/,/styles.css,/script.jsall 200 on loopback port 8081The 6 remaining exact IDs are:
musl 1.2.6-r3:CVE-2026-107891(Scout: High, suggests1.2.6-r6), but Alpine v3.24's branch-specific security advisory states1.2.6-r3already contains the fix: https://osv.dev/vulnerability/ALPINE-CVE-2026-107891 . Treat the cross-branch Scout mismatch as likely a false positive, not a reason to install Alpine edge libraries.openssl 3.5.9-r0:CVE-2026-107496,CVE-2026-88822,CVE-2026-88823,CVE-2026-95691,CVE-2026-95692(Scout: Unspecified; its advisory suggests3.5.9-r1). Alpine v3.24 stable currently lists3.5.9-r0: https://pkgs.alpinelinux.org/packages?arch=x86_64&branch=v3.24&name=openssl&repo=main . Track these findings and rebuild/retest when a stable patch is released; don't substitute Alpine edge libraries.The verification collector's optional text outputs (quickview, policy, recommendations, human-readable CVEs) contain a PowerShell exception triggered by a Docker Scout v1.28.0 update notice on stderr. The structured SARIF is intact and valid, and so are the image metadata and HTTP checks. Therefore do not claim a current PR #295 Scout policy score; root-user default also remains (no explicit
Config.User).Result: 72.7% fewer reported CVEs under the same Docker Scout scanner; existing Critical/Medium/Low reports disappear. PR remains HTTP-only and unmerged. No complete remediation or zero-CVE claim.
Final CI verification of SBOM/provenance change (2026-11-15)
provenance: mode=maxandsbom: true.sha256:5f8fb82286000b147f7552a0550fb59708034f3ac4e6d5c185177f8add0cd179; scanned at 2026-11-15 12:40:17 UTC.HTTP-only remains the default. The image is not merged or republished; the Nginx runtime still defaults to root and does not claim to pass the non-root policy.
Why this PR
The published
ghcr.io/thisis-developer/markdown-viewer:latestimage was reported by Docker Scout with 22 vulnerabilities (1 Critical, 5 High, 6 Medium, 5 Low, 5 Unspecified). The identical slim-base and stable-upgrade approach was separately tested in closed, unmerged PR #294: an earlier GitHub Actions workflow succeeded (https://github.com/ThisIs-Developer/Markdown-Viewer/actions/runs/43618088864), with Trivy reporting zero for the audited image. A subsequent Docker Scout rescan of the PR #294 candidate still found 6 CVEs (0 Critical, 1 High, 5 Unspecified) in musl/OpenSSL; these should not be described as eliminated.Verification
markdown-viewer:security-audit. This is a Trivy result only, not a Docker Scout clearance.latestdigest is published and scan the resulting image; the current publishedlatestdoes not change merely by opening this PR.Security caveat
Trivy and Docker Scout may disagree about vendor advisory severities/fixed versions. The previous candidate's remaining OpenSSL findings should be tracked until stable security updates exist. A passing Trivy gate is not a claim of zero CVEs or of zero exploitation risk. The original Dockerfile's missing asset/precache issues are outside this security-only PR.
Related: #290, #292, and closed PR #294.