[Snyk] Security upgrade alpine from 3.16 to 3.18.12

[cruizen]

Snyk has created this PR to fix 2 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

• hostplumber/pkg/ovs-docker/Dockerfile

We recommend upgrading to alpine:3.18.12, as this image has only 0 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Out-of-bounds Write SNYK-ALPINE316-BUSYBOX-6913410	514
	Out-of-bounds Write SNYK-ALPINE316-BUSYBOX-6913410	514
	CVE-2025-26519 SNYK-ALPINE316-MUSL-8720632	364
	CVE-2025-26519 SNYK-ALPINE316-MUSL-8720632	364

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

Summary by Bito

This pull request upgrades the base Docker image from alpine:3.16 to alpine:3.18.12 in the hostplumber/pkg/ovs-docker/Dockerfile. The change addresses critical security vulnerabilities and improves the overall security posture of the deployment environment. The update was automatically generated by Snyk to ensure Dockerfile dependencies are secure and up-to-date. This focused security improvement maintains compatibility while reducing risk.

[bito-code-review]

Code Review Agent Run #9ce1df

Actionable Suggestions - 0

Review Details

• Files reviewed - 1 · Commit Range: b803345..b803345

  • hostplumber/pkg/ovs-docker/Dockerfile
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at [email protected].

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[windsurf-bot]

Looks good to me 🤙

💡 To request another review, post a new comment with "/windsurf-review".

[bito-code-review]

Changelist by Bito

This pull request implements the following key changes.

Key Change	Files Impacted
Other Improvements - Security Docker Image Update	- Dockerfile - Upgraded base image from alpine:3.16 to alpine:3.18.12 to address security vulnerabilities.

[bito-code-review]

Interaction Diagram by Bito

sequenceDiagram
participant Dev as Developer
participant Repo as Git Repository
participant Docker as 🔄 Dockerfile<br/>(MODIFIED)
participant CI as GitHub Actions
participant Registry as Quay Registry
participant Controller as Luigi Controller
participant K8s as Kubernetes Cluster
participant OVS as OVS DaemonSet
Note over Docker: Alpine base updated<br/>3.16 -> 3.18.12
Dev->>Repo: Push Dockerfile changes
Repo->>CI: Trigger ovs-build-and-push workflow
CI->>Docker: Build OVS container image
Docker->>Registry: Push quay.io/platform9/openvswitch
Controller->>Registry: Pull updated OVS image
Controller->>K8s: Deploy NetworkPlugin manifests
K8s->>OVS: Create/update OVS DaemonSet pods
OVS-->>K8s: OVS services running on new Alpine

Loading

Critical path: Git Repository->Dockerfile (MODIFIED)->GitHub Actions->Quay Registry->Luigi Controller->Kubernetes Cluster->OVS DaemonSet

Note: The Alpine Linux base image update in the OVS Dockerfile triggers a CI/CD pipeline that rebuilds and pushes the OpenVSwitch container image. This updated image is then deployed by the Luigi NetworkPlugins controller to Kubernetes clusters as OVS DaemonSets, providing updated network infrastructure with the newer Alpine base.