Several Vulnerabilities even on latest

[heclemen]

Description
A safer 'striped down' image would be helpful for environments that have stricter compliance policies.

solution
Using an image with less packages would make it easier to maintain without vulnerabilities, see #164.

alternative
Recurrent problematic packages (krb / pcre / curl / wget) can be removed after zookeeper download and untar.

[acdha]

This is likely to get more reports since AWS Inspector relatively recently changed to start reporting Go toolchain vulnerabilities based on the metadata embedded in statically-linked Go binaries and that means that just having gosu installed will generate 🔥 CRITICAL 🔥 alerts despite there being no actual vulnerability in that package. In my case, the path of least-resistance was to remove the package since it's not needed if you have USER zookeeper but it generated a lot of noise.

[heclemen]

@@acdha Thank you for the feedback! I'll give it a try.

Can you clarify what you meant by "but it generated a lot of noise."?

[acdha]

Can you clarify what you meant by "but it generated a lot of noise."?

I think there are currently 2 “CRITICAL” CVEs in the 1.81.1 Go stdlib – none of which actually affect gosu – and a couple of HIGHs, so what I saw was that each registry in each project which uses ZK got multiple false-positive findings, so I ended up having to push the fix to a number of places since we have isolated registries for different environments. Since it's such a common dependency for distributed apps I imagine a lot of people are copies of the container image in their registries.

[acdha]

(and, to be clear, this is not a request that you spend time on this since it's hardly your problem but I expect more tools will be flagging it based on the embedded stdlib version information unless the vendor has some kind of filter to suppress known-non-vulnerable binaries)