From b3eb0426097ade7fc9f0b5b766a4de7e4983a898 Mon Sep 17 00:00:00 2001 From: David Mabry Date: Fri, 17 Jul 2026 10:13:10 -0500 Subject: [PATCH 1/5] Fix: Dockerfile --chown for non-root user permissions --- Dockerfile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 5574661..ef90653 100644 --- a/Dockerfile +++ b/Dockerfile @@ -26,7 +26,7 @@ RUN addgroup -S flowgre && \ adduser -S -g flowgre flowgre WORKDIR /opt/app -COPY --from=build-stage /flowgre ./flowgre +COPY --chown=flowgre:flowgre --from=build-stage /flowgre ./flowgre USER flowgre @@ -34,10 +34,10 @@ ENTRYPOINT ["/opt/app/flowgre"] # OCI labels — version is injected at build time via --build-arg ARG VERSION=dev -LABEL org.opencontainers.image.source="https://github.com/dmabry/flowgre" \ +LABEL org.opencontainers.image.version="${VERSION}" \ + org.opencontainers.image.source="https://github.com/dmabry/flowgre" \ org.opencontainers.image.description="NetFlow v9 / IPFIX packet generator for collector stress testing" \ - org.opencontainers.image.licenses="Apache-2.0" \ - org.opencontainers.image.version="${VERSION}" + org.opencontainers.image.licenses="Apache-2.0" # No HEALTHCHECK — flowgre is a CLI tool, not a daemon. # The /health endpoint only exists in barrage mode with -web flag. From c32e18ea0e5431e4a757a4fc5ab71952e2e01617 Mon Sep 17 00:00:00 2001 From: David Mabry Date: Fri, 17 Jul 2026 10:36:06 -0500 Subject: [PATCH 2/5] Update: Alpine base image to 3.24 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index ef90653..a6c2c7d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -20,7 +20,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -ldflags "-s -w" -o / # --------------------------------------------------------------------------- # Runtime stage — minimal Alpine image, non-root user # --------------------------------------------------------------------------- -FROM alpine:3.21 +FROM alpine:3.24 RUN addgroup -S flowgre && \ adduser -S -g flowgre flowgre From b552e2928c9a4a91c96677d7f27988710bb17ad3 Mon Sep 17 00:00:00 2001 From: David Mabry Date: Fri, 17 Jul 2026 10:53:06 -0500 Subject: [PATCH 3/5] Update: pin Alpine 3.24, inject version via ldflags, add vendor label --- Dockerfile | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index a6c2c7d..3437004 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ # --------------------------------------------------------------------------- # Build stage — compile a fully static binary (CGO_ENABLED=0) # --------------------------------------------------------------------------- -FROM golang:1.26-alpine AS build-stage +FROM golang:1.26-alpine3.24 AS build-stage WORKDIR /src @@ -12,10 +12,12 @@ WORKDIR /src COPY go.mod go.sum ./ RUN go mod download +ARG VERSION=dev + # Copy source and build a static binary. # TARGETARCH is auto-injected by BuildKit (arm64 on this host, amd64 on CI). COPY . . -RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -ldflags "-s -w" -o /flowgre . +RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -ldflags "-s -w -X main.version=${VERSION}" -o /flowgre . # --------------------------------------------------------------------------- # Runtime stage — minimal Alpine image, non-root user @@ -37,7 +39,8 @@ ARG VERSION=dev LABEL org.opencontainers.image.version="${VERSION}" \ org.opencontainers.image.source="https://github.com/dmabry/flowgre" \ org.opencontainers.image.description="NetFlow v9 / IPFIX packet generator for collector stress testing" \ - org.opencontainers.image.licenses="Apache-2.0" + org.opencontainers.image.licenses="Apache-2.0" \ + org.opencontainers.image.vendor="dmabry" # No HEALTHCHECK — flowgre is a CLI tool, not a daemon. # The /health endpoint only exists in barrage mode with -web flag. From ac05d85f50e6930ddd21bfb6257abfb6e91eade2 Mon Sep 17 00:00:00 2001 From: David Mabry Date: Fri, 17 Jul 2026 10:54:49 -0500 Subject: [PATCH 4/5] Fix: use 'Flowgre Team' vendor label for consistency --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 3437004..4140e20 100644 --- a/Dockerfile +++ b/Dockerfile @@ -40,7 +40,7 @@ LABEL org.opencontainers.image.version="${VERSION}" \ org.opencontainers.image.source="https://github.com/dmabry/flowgre" \ org.opencontainers.image.description="NetFlow v9 / IPFIX packet generator for collector stress testing" \ org.opencontainers.image.licenses="Apache-2.0" \ - org.opencontainers.image.vendor="dmabry" + org.opencontainers.image.vendor="Flowgre Team" # No HEALTHCHECK — flowgre is a CLI tool, not a daemon. # The /health endpoint only exists in barrage mode with -web flag. From 51ae481408488b614dcf6ef393606f0a42b40948 Mon Sep 17 00:00:00 2001 From: David Mabry Date: Fri, 17 Jul 2026 11:07:36 -0500 Subject: [PATCH 5/5] Add: docker-compose.yml and Docker image scanning to security workflow --- .github/workflows/security.yml | 13 ++++++++++++- docker-compose.yml | 18 ++++++++++++++++++ 2 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 docker-compose.yml diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 288c0ba..b5af664 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -29,9 +29,20 @@ jobs: run: | go install github.com/securego/gosec/v2/cmd/gosec@v2.22.2 gosec -exclude=G115 ./... - - name: Run Trivy vulnerability scanner + - name: Run Trivy vulnerability scanner (filesystem) uses: aquasecurity/trivy-action@bfa4b33a029b9aa80ddb784b45574c30e072c59e # 0.24.0 with: scan-type: 'fs' severity: 'CRITICAL,HIGH' exit-code: '1' + + - name: Build Docker image + run: | + docker build -t flowgre:scan --build-arg VERSION=scan . + + - name: Run Trivy vulnerability scanner (Docker image) + uses: aquasecurity/trivy-action@bfa4b33a029b9aa80ddb784b45574c30e072c59e # 0.24.0 + with: + image-ref: 'flowgre:scan' + severity: 'CRITICAL,HIGH' + exit-code: '1' diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..fe57eb0 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,18 @@ +services: + flowgre: + build: + context: . + dockerfile: Dockerfile + args: + VERSION: dev + image: flowgre:dev + container_name: flowgre + network_mode: "host" + # Override command - examples: + # single mode: + # command: ["single", "-server", "127.0.0.1", "-port", "9995", "-count", "10"] + # barrage mode: + # command: ["barrage", "-server", "127.0.0.1", "-port", "9995", "-workers", "2", "-delay", "100"] + # ipfix mode: + # command: ["ipfix", "-server", "127.0.0.1", "-port", "9995", "-count", "10"] + command: ["--help"] \ No newline at end of file