From fea264b909342491d0e6d8b629f3738e27479a21 Mon Sep 17 00:00:00 2001 From: bgard68 Date: Tue, 25 Aug 2026 05:50:44 +0000 Subject: [PATCH] build(deps): refresh the pinned base image digests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clears the four open Trivy alerts on the API image (two systemd CVEs, each reported twice): a local privilege escalation via systemd-homed, and an unprivileged local user being able to terminate arbitrary processes. Both are Debian packages inside the base image, not application code. The scan runs with ignore-unfixed, so anything it reports has a patch available — these were waiting on nothing but a digest refresh. Pinning by digest is what makes the base auditable (review finding M10), and the cost of that is exactly this: the pin has to be moved deliberately when the upstream image is rebuilt. sdk:10.0 e1fc6e42… -> e1ffd2a9… aspnet:10.0 207cc514… -> a4556ed0… Both taken from mcr.microsoft.com today, the way the comment at the top of the file describes. Container build & scan runs on this path, so its own Trivy step is the check on whether this actually cleared them. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_019h7znwAftvs36vD4YwKMRf --- Dockerfile.api | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile.api b/Dockerfile.api index 5a954a9..ddf7750 100644 --- a/Dockerfile.api +++ b/Dockerfile.api @@ -6,7 +6,7 @@ # Dockerfile can produce a different image tomorrow, so a reproducible build and an audited # base are impossible with tags alone. Refresh with: # docker buildx imagetools inspect mcr.microsoft.com/dotnet/sdk:10.0 --format '{{.Manifest.Digest}}' -FROM mcr.microsoft.com/dotnet/sdk:10.0@sha256:e1fc6e423f543119c406d24e2e687d67c569f18f04a37a8b0005d80ad0dcee80 AS build +FROM mcr.microsoft.com/dotnet/sdk:10.0@sha256:e1ffd2a92ae84c1291bc1b6887501f8af98e6331e7af6d4c8d37168c5e87a64c AS build WORKDIR /src # Restore first (leverages layer caching) by copying only the project files and lock files. @@ -28,7 +28,7 @@ COPY src/ src/ RUN dotnet publish src/TodoApp.WebApi/TodoApp.WebApi.csproj \ -c Release -o /app/publish --no-restore /p:UseAppHost=false -FROM mcr.microsoft.com/dotnet/aspnet:10.0@sha256:207cc51496778557731c81ff670333d8ade4a4fec22768fd1be8e78474a84ecf AS final +FROM mcr.microsoft.com/dotnet/aspnet:10.0@sha256:a4556ed033fa96f984bb7a8d348851cb2d36b1281dd2420070045f664fbb5f94 AS final WORKDIR /app COPY --from=build /app/publish .