fix: resolve 5 HIGH Trivy misconfiguration findings#840
Merged
marcusburghardt merged 2 commits intocomplytime:mainfrom Apr 27, 2026
Merged
Conversation
Contributor
Author
|
Failing CI tests are not in scope of this PR. They will be addressed in separate PRs in order to keep the scope simple. |
marcusburghardt
force-pushed
the
fix/trivy-high-misconfigurations
branch
from
2f0568a to
e74bf60
Compare
- .devcontainer/Dockerfile: add explicit dnf/yum clean all (DS-0015, DS-0017) - Dockerfile: add USER 1001 to final stage to avoid running as root (DS-0002) - tests/e2e/play-kube.yml: add pod-level securityContext with runAsNonRoot and readOnlyRootFilesystem with emptyDir for WireMock (KSV-0118, KSV-0014) Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
Trivy DS-0017 requires that the package manager used for "update" matches the one used for "install" within the same RUN instruction. The previous Dockerfile mixed dnf (update) with yum (reinstall, install), causing Trivy to flag "dnf update" as running alone. Since yum is a symlink to dnf on Fedora, switch all commands to dnf. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
marcusburghardt
force-pushed
the
fix/trivy-high-misconfigurations
branch
from
e74bf60 to
1789fa9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes all 5 HIGH-severity Trivy misconfiguration findings that block the
OSV-Scanner / Trivy Source ScanCI job.Changes
.devcontainer/Dockerfile(DS-0015 + DS-0017)dnf clean all && yum clean allto the package installRUNinstruction. The previousrm -rf /var/cachewas functionallyequivalent but Trivy requires the canonical clean commands.
Dockerfile(DS-0002)USER 1001to thefinalstage so the production container nolonger runs as root. UBI minimal supports arbitrary UIDs without
requiring
useradd.tests/e2e/play-kube.yml(KSV-0118 + KSV-0014)securityContextwithrunAsNonRoot: trueandrunAsUser: 1001(consistent with the e2e test Dockerfile'sUSER 1001).readOnlyRootFilesystem: trueto the containersecurityContext.emptyDirvolume at/home/wiremockso WireMock can stillwrite to its working directory.
Findings addressed
.devcontainer/Dockerfileyum clean allmissing.devcontainer/DockerfileRUN <pkg-mgr> updatewithout cleanDockerfiletests/e2e/play-kube.ymltests/e2e/play-kube.yml