https://www.runatlantis.io/ logo
Join Slack
Powered by
This message was deleted.
# atlantis-community
s
This message was deleted.
e
I'm using the most current base image 
docker pull <http://ghcr.io/runatlantis/atlantis:dev-alpine-1a9714a|ghcr.io/runatlantis/atlantis:dev-alpine-1a9714a>
https://github.com/runatlantis/atlantis/pkgs/container/atlantis
p
when was this packed updated?
you need to calculate from the last image to now basically
e
a day ago?
p
if is between that window then it will be fixed in the 0.26 release
no I mean the latest release
e
sorry, I am new at docker, where do I find the most updated and correct release?
p
use latest tag
that is the last stable
e
I was using that before šŸ˜ž
p
dev is for every merge
thankyou 1
e
Copy code
docker pull <http://ghcr.io/runatlantis/atlantis:latest|ghcr.io/runatlantis/atlantis:latest>
p
that is why Iā€™m saying from the last time we released 0.25 until today we have no updated that package if that package was updated in between release cycles
well that is strange
e
Copy code
docker pull <http://ghcr.io/runatlantis/atlantis:0.25|ghcr.io/runatlantis/atlantis:0.25>
can I call the exact 0.25 version like this?
I will check with out team tomorrow too
Thank you @PePe Amengual! I'll let you know. I'm sure its something on our end if you say its updated
p
ok
e
I wonder if it has to do with the packages in the terraform binary šŸ¤”

https://files.slack.com/files-pri/T5MGGAQ4C-F064N836D37/img_2555.jpgā–¾

p
we checked and that was updated 2 years ago
do.our image is up to date
šŸ‘ 1
if terraform uses that then that could be
e
p
e
So we tested with dev-alphine-1a9714a and the original vulnerability I sent yesterday is gone. We still have 22 High vulnerabilities
Could we download these packages manually for the base image that its telling us to update (I attached 3)? Just some reference
IMG_2556.HEICIMG_2558.HEICIMG_2557.HEIC
p
what do you mean?
e
Customize the docker image essentially as the documentation says we can, just needed more examples since some of these are difficult to find the command online
t
Was just dealing with this today. Those packages are all mentioned as part of a binary packaged in the container such as 
terraform1.5.7
or 
conftest
so I think you would need the terraform or conftest maintainers to release a version containing the fixed packages.
šŸ‘ 1
But also is the terraform binary really vulnerable to HTTP/2 protocol attacks? I doubt it
p
if there are patches on a 1.5.x version for that, we can use that
šŸ‘ 1
e
Thank you @Tim Wisbauer ! Sadly I dont get to decide what aquascans find vulnerable and how it ranks it. šŸ˜ž . We have 22 high vulnerabilities and 1 critical when using 
latest
, in our organization we won't be able to use the atlantis-docker base image as it is now.
p
if you build your own you can
just use the Dockerfile as a base
t
That's what we did. I removed the older versions of Terraform since we don't need them anyway and got down to 6 Highs and 6 Mediums.
Copy code
RUN rm /usr/local/bin/terraform1.2.*
RUN rm /usr/local/bin/terraform1.3.*
RUN rm /usr/local/bin/terraform1.4.*
p
the other highs are where?
in atlantis binary itself?
t
I can't tell. My scanner just tells me they exist and I actually had to rely on the screenshots from Emery to figure out it was the 
terraform
binaries šŸ™
e
We are planning to do that @PePe Amengual, just need time and may reach a dead end anyway. Thank you @Tim Wisbauer, I'll try it on my end tomorrow. I forgot the exact number of vulnerabilities, but most of them were from 
terraform
binaries and few from 
conftest
p
we can help the atlantis binary side and onto update to TF or conftest versions that do not have those vulnerabilities
šŸ™ 1
but if they do not have a patch then that will be more tricky
šŸ˜ž 1
e
Hi @PePe Amengual and @Tim Wisbauer, I didn't have a chance to deploy our own custom image by removing the older binaries. I did however jot down the aquascan results that were ran today (the critical one is now gone from the 
latest
version).
atlantis_vulnerabilities.csv
p
ok, we can use this to update libraries for Atlantis if is needed
e
That would be great if possible, otherwise when we find time and I get better with docker itself, I will customize the image off of the base image. Thank you and sorry for the trouble !
Hi @Tim Wisbauer, Were you able to get rid of all the high vulnerabilities?
t
No, I'm just living with my 6 HIGH
e
šŸ˜‚ Thank you for the update!
šŸ‘ 1
I forgot to update, maybe the solution below will help someone else. But we were able to get rid of all vulnerabilities and pass the aquascans (version 0.27.0) as of Jan 9th 2023 (who knows what new vulnerabilities will occur in the future). Essentially we removed many things and then reinstalled the most recent terraform and conftest. Not the cleanest but it got the job done thanks to my colleague. The openssh one was a high vulnerability classified in December 2023.
Copy code
RUN rm -rf /bin/gosu; \
    rm -rf /usr/bin/git-lfs; \
    rm -rf /usr/local/conftest; \
    rm -rf /usr/local/bin/terraform*; \
    apk del openssh 

#example of downloading a specific terraform binary. 
RUN curl <https://path_to_terraform.zip> -o /usr/local/bin/terraform.zip; \
    unzip /usr/local/bin/terraform.zip; \
    rm /usr/local/bin/terraform.zip; \
    mv terraform /usr/local/bin/terraform
Open in Slack
PreviousNext
Powered by