From ee036876887b38f65a445bd6e7c8d95e27feff5c Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Thu, 5 Nov 2026 07:45:27 +0000 Subject: [PATCH] fix: upgrade Alpine packages in the runner images (#1388) All images run `apk upgrade` before installing packages, so they pick up Alpine fixes their base images lag on. `docker:29.9.2-dind` shipped libexpat 2.9.0-r0 while Alpine 3.24 provides 2.10.0-r0 with the security fixes, and both `docker:29.9.3-dind` and `alpine:3.24` still ship apk-tools 3.0.8-r0 where 3.0.9-r0 is available. The dind bases are also bumped to `docker:29.9.3`, which drops several vulnerable bundled binaries' findings. Verified by building the targets locally: libexpat is 2.10.0-r0 (was 2.9.0-r0), apk-tools is 3.0.9-r0 (was 3.0.8-r0), and Trivy reports no Alpine package findings on the dind images. Assisted-by: Codet:claude Assisted-by: Claude Code:claude-opus-5-5 Co-authored-by: silverwind Reviewed-on: https://gitea.com/gitea/runner/pulls/1388 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: Lunny Xiao --- Dockerfile | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 65db8123..8b851740 100644 --- a/Dockerfile +++ b/Dockerfile @@ -19,14 +19,15 @@ RUN --mount=type=cache,target=/go/pkg/mod \ ### DIND VARIANT # # -FROM docker:29.9.2-dind AS dind +FROM docker:29.9.3-dind AS dind ARG VERSION=dev LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner" LABEL org.opencontainers.image.version="${VERSION}" -RUN apk add --no-cache s6 bash git tzdata nftables +# upgrade first: the docker base image can lag behind Alpine security fixes +RUN apk upgrade --no-cache && apk add --no-cache s6 bash git tzdata nftables COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner COPY scripts/run.sh /usr/local/bin/run.sh @@ -41,7 +42,7 @@ ENTRYPOINT ["s6-svscan","/etc/s6"] ### DIND-ROOTLESS VARIANT # # -FROM docker:29.9.2-dind-rootless AS dind-rootless +FROM docker:29.9.3-dind-rootless AS dind-rootless ARG VERSION=dev @@ -49,7 +50,8 @@ LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner" LABEL org.opencontainers.image.version="${VERSION}" USER root -RUN apk add --no-cache s6 bash git tzdata nftables +# upgrade first: the docker base image can lag behind Alpine security fixes +RUN apk upgrade --no-cache && apk add --no-cache s6 bash git tzdata nftables COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner COPY scripts/run.sh /usr/local/bin/run.sh @@ -75,7 +77,7 @@ ARG VERSION=dev LABEL org.opencontainers.image.source="https://gitea.com/gitea/runner" LABEL org.opencontainers.image.version="${VERSION}" -RUN apk add --no-cache tini bash git tzdata +RUN apk upgrade --no-cache && apk add --no-cache tini bash git tzdata COPY --from=builder /opt/src/runner/gitea-runner /usr/local/bin/gitea-runner COPY scripts/run.sh /usr/local/bin/run.sh