Skip to content

ROB-626: rebuild on fresh base to fix libcrypto3/openssl CVEs #114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Avi-Robusta wants to merge 1 commit into from
Closed

ROB-626: rebuild on fresh base to fix libcrypto3/openssl CVEs #114

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,18 +2,19 @@
# Patching CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820,
# CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501,
# CVE-2026-42504, CVE-2026-42507, CVE-2026-27145: requires Go >= 1.26.4
FROM golang:1.26.4 AS builder
# Build on the native build platform and cross-compile to the target arch with the
# Go toolchain. This avoids running the Go compiler under QEMU emulation (which can
# crash), so multi-arch builds (linux/amd64 + linux/arm64) work reliably.
FROM --platform=$BUILDPLATFORM golang:1.26.4 AS builder

RUN apt-get update && \
dpkg --add-architecture arm64 &&\
apt-get install -y --no-install-recommends build-essential && \
apt-get clean && \
mkdir -p "$GOPATH/src/github.com/bitnami-labs/kubewatch"
RUN mkdir -p "$GOPATH/src/github.com/bitnami-labs/kubewatch"

ADD . "$GOPATH/src/github.com/bitnami-labs/kubewatch"

ARG TARGETOS=linux
ARG TARGETARCH
RUN cd "$GOPATH/src/github.com/bitnami-labs/kubewatch" && \
CGO_ENABLED=0 GOOS=linux GOARCH=$(dpkg --print-architecture) go build -a --installsuffix cgo --ldflags="-s" -o /kubewatch
CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -a --installsuffix cgo --ldflags="-s" -o /kubewatch

# Patching CVE-2026-4046, CVE-2026-4437: requires glibc >= 2.44, provided by chainguard/bash built after May 2026
FROM cgr.dev/chainguard/bash:latest
Expand Down
Loading