c0ce3524b6
Base images - api, llm, docs(extract), notebooks(wheel): uv:python3.13-bookworm-slim -> uv:0.13.2-python3.13-trixie-slim. Debian 12 left regular security support in June 2026; a pinned uv tag makes base changes a reviewed diff Renovate can bump. notebooks copies /uv from the same tag instead of uv:latest. - api, llm: `uv sync --locked` — a stale lock now fails the build instead of silently re-resolving to packages pkg-supply-chain never scanned. - api, llm: uninstall the base image's system pip. Nothing runs it (uv owns the venv), and its vendored certifi/urllib3/msgpack/setuptools were the image's only language-level findings. - notebooks: the workspace resolves at build time with no committed lock, so it gets the same 7-day cooldown via ENV UV_EXCLUDE_NEWER (ENV, not a prefix — the recorded span must match at `uv run` time). - docs: pnpm 10.12.1 -> 10.34.7 to match packageManager. trivy HIGH/CRITICAL, deployed image -> this build: api 11 crit / 94 high -> 0 / 48 llm 9 / 129 -> 1 / 70 docs 0 / 38 -> 0 / 0 mc 2 / 52 -> 0 / 0 What's left is Debian `affected` with no fix released (libxml2 is the llm critical); the weekly Harden --pull rebuild picks fixes up as they land. mc sidecar MinIO archived the open-source client: quay.io/minio/mc answers 401, dl.min.io 410 Gone, and there are no more security fixes. The service keeps its name but ships rustfs/rc v0.1.36 on alpine:3.24 — same alias grammar (RC_HOST_local=http://key:secret@rustfs:9000), same admin verbs (`docker exec mc rc admin policy create local/ <name> <file>`), same hardening (uid 10002, read-only root, no caps). Verified against the live RustFS: `rc ls local/` lists all six buckets, `rc admin user list` reaches the admin API. Config dir moves to a tmpfs at /home/mc/.config/rc. Refs #1365
18 lines
832 B
Docker
18 lines
832 B
Docker
# syntax=docker/dockerfile:1
|
|
# Object-store admin sidecar for RustFS — least-privilege IAM/bucket helper.
|
|
# The service keeps its `mc` name, but the binary is RustFS's own `rc`
|
|
# (github.com/rustfs/cli): MinIO archived the open-source mc — no security
|
|
# updates, quay.io/minio/mc now 401s and dl.min.io answers 410 Gone. rc speaks
|
|
# the same alias grammar (`RC_HOST_local=http://key:secret@host:port`) and
|
|
# admin verbs: `docker exec mc rc admin policy create local/ <name> <file>`.
|
|
# Pinned tags so a base-image change is a reviewed diff (Renovate bumps both).
|
|
# Runs as non-root, read-only filesystem, no capabilities.
|
|
FROM rustfs/rc:v0.1.36 AS rc
|
|
|
|
FROM alpine:3.24
|
|
RUN apk upgrade --no-cache \
|
|
&& addgroup -g 10002 -S mc && adduser -u 10002 -S mc -G mc
|
|
COPY --from=rc /usr/bin/rc /usr/bin/rc
|
|
USER mc:mc
|
|
ENTRYPOINT ["rc"]
|