P17: Hardened Containers — auto-patch vulns via CI/CD
Harden all custom Docker images against known CVEs. apt upgrade + pin deb sources, run as non-root, add HEALTHCHECK directives, add a CI hardening pipeline that blocks on HIGH/CRITICAL Trivy findings, and auto-close resolved vuln issues.
Closeout
All 6 issues closed. Every custom image (notebooks, zotero, docs, api) hardened: apt upgrade applied, deb sources pinned to prevent supply chain drift, USER directive set to non-root, and HEALTHCHECK added for orchestrator liveness probes. A dedicated hardening CI pipeline blocks merges if Trivy finds HIGH or CRITICAL vulnerabilities. Added --close mode to api.diag.vuln so resolved vulnerabilities auto-close their corresponding Gitea issues when a subsequent scan shows them fixed.
Issues resolved
- #123 — Hardened notebooks image (apt upgrade, non-root, HEALTHCHECK)
- #124 — Hardened zotero image (apt upgrade, pinned deb source, HEALTHCHECK)
- #125 — Hardened docs image (pinned nginx, non-root, HEALTHCHECK)
- #126 — Hardened api image (apt upgrade, non-root, HEALTHCHECK)
- #127 — Hardening pipeline: blocks on HIGH/CRITICAL, auto-closes vuln issues
- #128 — --close mode for api.diag.vuln auto-closes resolved vulns
Residual
None. Ongoing vulnerability management handled by the hardening pipeline in CI.
