From 275d9b34a174e4e1449bf2939b1cfa88c0465e4d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Juli=C3=A1n=20Cea=20Mor=C3=A1n?=
 <36761132+juanjucm@users.noreply.github.com>
Date: Thu, 24 Sep 2026 14:02:31 +0200
Subject: [PATCH] Add CVE safeguards in Dockerfiles

---
 Dockerfile      | 4 +++-
 Dockerfile.cuda | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index ee1e7e5..e2030ae 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -78,7 +78,9 @@ RUN --mount=type=cache,id=sys1-sccache,target=/root/.cache/sccache,sharing=locke
 FROM debian:bookworm-slim AS runtime
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates \
+    && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
 RUN useradd --system --uid 10001 --create-home sys1
diff --git a/Dockerfile.cuda b/Dockerfile.cuda
index 2319ba3..f540147 100644
--- a/Dockerfile.cuda
+++ b/Dockerfile.cuda
@@ -127,7 +127,9 @@ FROM nvidia/cuda:${CUDA_VERSION}-runtime-ubuntu${UBUNTU_VERSION} AS runtime
 ARG CUDA_COMPAT_VERSION
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends ca-certificates "cuda-compat-${CUDA_COMPAT_VERSION}" \
+    && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        ca-certificates "cuda-compat-${CUDA_COMPAT_VERSION}" \
     && rm -rf /var/lib/apt/lists/*
 
 RUN useradd --system --uid 10001 --user-group --create-home sys1 \