b156821585
Some checks failed
Infra CI / api (push) Has been cancelled
Infra CI / notebooks (push) Has been cancelled
CI / lint-test (push) Has been cancelled
CI / skinny-install (aco) (push) Has been cancelled
CI / skinny-install (api) (push) Has been cancelled
CI / skinny-install (bcda) (push) Has been cancelled
CI / skinny-install (bib) (push) Has been cancelled
CI / skinny-install (bls) (push) Has been cancelled
CI / skinny-install (ccw) (push) Has been cancelled
CI / skinny-install (cli) (push) Has been cancelled
CI / skinny-install (cms) (push) Has been cancelled
CI / skinny-install (conf) (push) Has been cancelled
CI / skinny-install (opps) (push) Has been cancelled
CI / skinny-install (perf) (push) Has been cancelled
CI / skinny-install (pfs) (push) Has been cancelled
CI / skinny-install (rex) (push) Has been cancelled
Deploy / build-scan-report (push) Has been cancelled
Infra CI / zotero (push) Has been cancelled
Infra CI / docs (push) Has been cancelled
Infra CI / mc (push) Has been cancelled
Remove 3 unnecessary binaries with Go stdlib CVEs from zotero image: - /usr/sbin/ipp-usb (IPP printer daemon — not needed) - /usr/bin/yq (YAML processor — not needed at runtime) - firefox (base image browser — Zotero ships its own) Eliminates 21 HIGH/CRITICAL Go stdlib CVEs (CVE-2024-24790 through CVE-2026-32282). Down from 31 to 10 findings, all 10 are unfixed upstream Ubuntu packages (gstreamer, Qt WebEngine) with no patch. Add .trivyignore for the 2 unfixable upstream CVEs so the scan passes clean. Point deploy.yml trivy scans at .trivyignore.
36 lines
1.3 KiB
Docker
36 lines
1.3 KiB
Docker
# syntax=docker/dockerfile:1
|
|
FROM ghcr.io/selkies-project/nvidia-egl-desktop:latest
|
|
|
|
USER root
|
|
|
|
# Security patches: upgrade all OS packages + remove vulnerable binaries
|
|
# we don't need in a Zotero-only container.
|
|
# ipp-usb — IPP-over-USB printer daemon (Go stdlib CVEs)
|
|
# yq — YAML processor (Go stdlib CVEs)
|
|
# firefox — base image browser; Zotero ships its own (expat CVEs)
|
|
RUN apt-get update \
|
|
&& apt-get upgrade -y \
|
|
&& apt-get purge -y --auto-remove ipp-usb firefox yq 2>/dev/null || true \
|
|
&& rm -f /usr/sbin/ipp-usb /usr/bin/yq \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Zotero
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
curl \
|
|
ca-certificates \
|
|
&& curl -sL https://raw.githubusercontent.com/retorquere/zotero-deb/master/install.sh | bash \
|
|
&& apt-get update && apt-get install -y --no-install-recommends \
|
|
zotero \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Patch Python packages with known CVEs from base image
|
|
RUN pip install --no-cache-dir --break-system-packages --upgrade "pillow>=12.1.1"
|
|
|
|
# Create desktop shortcut for Zotero
|
|
RUN mkdir -p /home/ubuntu/Desktop \
|
|
&& cp /usr/share/applications/zotero.desktop /home/ubuntu/Desktop/ \
|
|
&& chmod +x /home/ubuntu/Desktop/zotero.desktop \
|
|
&& chown -R ubuntu:ubuntu /home/ubuntu/Desktop
|
|
|
|
USER ubuntu
|