homelab/stack
1
0
Fork 0
Code Issues 70 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

P17: Hardened containers — auto-patch vulns via CI/CD #129

Merged
kert merged 1 commits from feature/hardened-containers into main 2026-03-23 18:20:55 +00:00
Conversation 0 Commits 1 Files Changed 7 +294 -14
kert commented 2026-03-23 18:16:39 +00:00
Owner
Copy Link

Summary

  • Harden all 4 Dockerfiles with apt-get upgrade / apk upgrade to patch base image CVEs
  • Add HEALTHCHECK directives to notebooks, docs, api images
  • New .woodpecker/harden.yml pipeline (manual/cron) that rebuilds with --no-cache, scans, and auto-closes vuln issues
  • New api.diag.vuln --close mode that closes Gitea vuln issues when scan is clean
  • 26 tests for vuln module including close mode

Issues addressed

Test plan

  • Merge PR
  • Run hardening pipeline manually from Woodpecker UI
  • Verify scans show fewer vulns after apt upgrade
  • Verify vuln issues auto-closed if scans are clean
  • Verify HEALTHCHECK works: docker inspect --format='{{.State.Health.Status}}' notebooks
## Summary - Harden all 4 Dockerfiles with `apt-get upgrade` / `apk upgrade` to patch base image CVEs - Add HEALTHCHECK directives to notebooks, docs, api images - New `.woodpecker/harden.yml` pipeline (manual/cron) that rebuilds with `--no-cache`, scans, and auto-closes vuln issues - New `api.diag.vuln --close` mode that closes Gitea vuln issues when scan is clean - 26 tests for vuln module including close mode ## Issues addressed - #123 Harden notebooks (refs #114) - #124 Harden zotero (refs #115) - #125 Harden docs (refs #116) - #126 Harden api (refs #117) - #127 Hardening pipeline - #128 Auto-close vuln issues ## Test plan - [ ] Merge PR - [ ] Run hardening pipeline manually from Woodpecker UI - [ ] Verify scans show fewer vulns after apt upgrade - [ ] Verify vuln issues auto-closed if scans are clean - [ ] Verify HEALTHCHECK works: `docker inspect --format='{{.State.Health.Status}}' notebooks`
kert added this to the P17: Hardened Containers — auto-patch vulns via CI/CD milestone 2026-03-23 18:16:39 +00:00
kert added 1 commit 2026-03-23 18:16:40 +00:00
trigger: test with fresh Gitea token
All checks were successful
coverage 99% coverage
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/push/infra-ci Pipeline was successful
Details
9f03a8e7ab
kert merged commit 8d83fbc245 into main 2026-03-23 18:20:55 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
api
REST API (FastAPI)
 auth
Authentication and authorization
 bib
Bibliography, Zotero, citations
 ci
CI/CD pipelines and Woodpecker plugins
 cli
CLI commands and UX
 cloud
Cloud provider abstraction (AWS, GCP, Azure, self-hosted)
 config
Configuration and wiring
 data
Data loading, CCLF, BCDA, seeds
 databricks
Databricks jobs and deployment
 docs
Documentation and generated references
 image:api
image:docs
image:mc
image:notebooks
image:zotero
infra
lakehouse
Nessie, Polaris, Trino, Iceberg
 llm
llm module — local RAG over comments + Zotero corpus
 notebooks
marimo notebook errors (auto-filed by nb-watcher/nb-integration)
 packaging
Python packaging, optional deps, build system
 pfs
pipeline
Pipeline execution and validation
 pipeline:ci
pipeline:deploy
pipeline:harden
pipeline:infra-ci
pipeline:rebuild-all
pipeline:release
qpp
quality
Testing, coverage, error handling
 step:build
step:deploy
step:hadolint
step:lint
step:publish
step:scan
step:test
step:validate
styles
Charts, figures, visual theming
 tree
Project directory structure and file organization
No Label
Milestone
No items
No Milestone P17: Hardened Containers — auto-patch vulns via CI/CD
Projects
Clear projects
No project
Assignees
Clear assignees
kert renovate-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: homelab/stack#129
Delete Branch "feature/hardened-containers"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?