is there a way to run datahub without datahub-actions? it contains tens of critical vulnerabilities

Hey there 👋 I'm The DataHub Community Support bot. I'm here to help make sure the community can best support you with your request. Let's double check a few things first: ✅ There's a lot of good information on our docs site: www.datahubproject.io/docs, Have you searched there for a solution? ✅ button ✅ It's not uncommon that someone has run into your exact problem before in the community. Have you searched Slack for similar issues? ✅ button Did you find a solution to your issue? ❌ Sorry you weren't able to find a solution. I'm sending you some tips on info you can provide to help the community troubleshoot. Whenever you feel your issue is solved, please react ✅ to your original message to let us know!

We have a acryldata/datahub-actions-slim image that you can use that’s smaller and more closely monitored for vulns

it still contains critical vulnerabilities because of the base image

Huh interesting - I believe the scanner that we’ve been using (trivy) only scans the final image. What vuln scanner are you using?

GCR, SNYK, GRYPE. log from google marketplace:

acryl-datahub-slim:v0.0.12
  Note: CVE-2022-25168
  Package: org.apache.hadoop:hadoop-common
  Package Type: MAVEN
  Affected Version: 3.2.0
  Fixed Version: 3.2.4
  Note: CVE-2022-37865
  Package: org.apache.ivy:ivy
  Package Type: MAVEN
  Affected Version: 2.4.0
  Fixed Version: 2.5.1
  Note: CVE-2023-22946
  Package: org.apache.spark:spark-core_2.12
  Package Type: MAVEN
  Affected Version: 3.0.3
  Fixed Version: 3.4.0
  Note: CVE-2019-0204
  Package: org.apache.mesos:mesos
  Package Type: MAVEN
  Affected Version: 1.4.0
  Fixed Version: 1.4.3
  Note: CVE-2021-33036
  Package: org.apache.hadoop:hadoop-yarn-server-common
  Package Type: MAVEN
  Affected Version: 3.2.0
  Fixed Version: 3.2.3
  Note: CVE-2022-26612
  Package: org.apache.hadoop:hadoop-common
  Package Type: MAVEN
  Affected Version: 3.2.0
  Fixed Version: 3.2.3
  Note: CVE-2023-24538
  Package: go
  Package Type: GO_STDLIB
  Affected Version: 1.20.2

Got it - we’ll test out with those scanners cc @brainy-tent-14503

my coworker fixed it in a fork @bulky-scientist-8960 , he can provide more info, or maybe PR for you if he wants, or I will with credit to him if he doesn’t