Skip to content
This repository was archived by the owner on Jan 11, 2025. It is now read-only.

Commit 03801d4

Browse files
fabiocicerchiafabiocicerchia
committed
added security checks with snyk
1 parent c0f4e40 commit 03801d4

File tree

59 files changed

+576
-544
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

59 files changed

+576
-544
lines changed

‎.github/workflows/main.yml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,12 @@ jobs:
2424
- name: Test images
2525
run: ./test/test.sh alpine
2626

27+
- name: Security Check
28+
run: |
29+
npm install -g snyk
30+
snyk auth $SNYK_AUTH_TOKEN
31+
./test/security.sh alpine
32+
2733
- name: Log into registry
2834
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
2935
if: github.ref == 'refs/heads/master'
@@ -43,6 +49,12 @@ jobs:
4349
- name: Test images
4450
run: ./test/test.sh amazonlinux
4551

52+
- name: Security Check
53+
run: |
54+
npm install -g snyk
55+
snyk auth $SNYK_AUTH_TOKEN
56+
./test/security.sh amazonlinux
57+
4658
- name: Log into registry
4759
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
4860
if: github.ref == 'refs/heads/master'
@@ -62,6 +74,12 @@ jobs:
6274
- name: Test images
6375
run: ./test/test.sh centos
6476

77+
- name: Security Check
78+
run: |
79+
npm install -g snyk
80+
snyk auth $SNYK_AUTH_TOKEN
81+
./test/security.sh centos
82+
6583
- name: Log into registry
6684
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
6785
if: github.ref == 'refs/heads/master'
@@ -81,6 +99,12 @@ jobs:
8199
- name: Test images
82100
run: ./test/test.sh debian
83101

102+
- name: Security Check
103+
run: |
104+
npm install -g snyk
105+
snyk auth $SNYK_AUTH_TOKEN
106+
./test/security.sh debian
107+
84108
- name: Log into registry
85109
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
86110
if: github.ref == 'refs/heads/master'
@@ -100,6 +124,12 @@ jobs:
100124
- name: Test images
101125
run: ./test/test.sh fedora
102126

127+
- name: Security Check
128+
run: |
129+
npm install -g snyk
130+
snyk auth $SNYK_AUTH_TOKEN
131+
./test/security.sh fedora
132+
103133
- name: Log into registry
104134
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
105135
if: github.ref == 'refs/heads/master'
@@ -119,6 +149,12 @@ jobs:
119149
- name: Test images
120150
run: ./test/test.sh ubuntu
121151

152+
- name: Security Check
153+
run: |
154+
npm install -g snyk
155+
snyk auth $SNYK_AUTH_TOKEN
156+
./test/security.sh ubuntu
157+
122158
- name: Log into registry
123159
run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u ${{ github.actor }} --password-stdin
124160
if: github.ref == 'refs/heads/master'

‎nginx/1.17.10/alpine/3.10.5/Dockerfile

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -49,45 +49,45 @@ RUN set -x \
4949
&& apk add --no-cache \
5050
geoip-dev \
5151
openssl-dev \
52-
pcre-dev \
52+
pcre3-dev \
5353
zlib-dev \
5454
&& apk add --no-cache --virtual .build-deps \
55+
curl \
5556
g++ \
5657
gzip \
5758
make \
5859
tar \
59-
wget \
6060
# OpenResty LUAJIT2
6161
# ##############################################################################
62-
&& wget https://github.com/openresty/luajit2/archive/v${VER_LUAJIT}.tar.gz -O /luajit.tar.gz \
62+
&& curl -Lo /luajit.tar.gz https://github.com/openresty/luajit2/archive/v${VER_LUAJIT}.tar.gz \
6363
&& tar xvzf /luajit.tar.gz && rm /luajit.tar.gz \
6464
&& cd /luajit2-${VER_LUAJIT} \
6565
&& make -j $(nproc) \
6666
&& make install \
6767
&& cd / \
6868
# LUA Resty Core
6969
# ##############################################################################
70-
&& wget https://github.com/openresty/lua-resty-core/archive/v${VER_LUA_RESTY_CORE}.tar.gz -O /lua-resty-core.tar.gz \
70+
&& curl -Lo /lua-resty-core.tar.gz https://github.com/openresty/lua-resty-core/archive/v${VER_LUA_RESTY_CORE}.tar.gz \
7171
&& tar xvzf /lua-resty-core.tar.gz && rm /lua-resty-core.tar.gz \
7272
&& cd /lua-resty-core-${VER_LUA_RESTY_CORE} \
7373
&& make -j $(nproc) \
7474
&& make install \
7575
&& cd / \
7676
# LUA Resty LRUCache
7777
# ##############################################################################
78-
&& wget https://github.com/openresty/lua-resty-lrucache/archive/v${VER_LUA_RESTY_LRUCACHE}.tar.gz -O /lua-resty-lrucache.tar.gz \
78+
&& curl -Lo /lua-resty-lrucache.tar.gz https://github.com/openresty/lua-resty-lrucache/archive/v${VER_LUA_RESTY_LRUCACHE}.tar.gz \
7979
&& tar xvzf /lua-resty-lrucache.tar.gz && rm /lua-resty-lrucache.tar.gz \
8080
&& cd /lua-resty-lrucache-${VER_LUA_RESTY_LRUCACHE} \
8181
&& make -j $(nproc) \
8282
&& make install \
8383
&& cd / \
8484
# NGX Devel Kit
8585
# ##############################################################################
86-
&& wget https://github.com/vision5/ngx_devel_kit/archive/v${VER_NGX_DEVEL_KIT}.tar.gz -O /ngx_devel_kit.tar.gz \
86+
&& curl -Lo /ngx_devel_kit.tar.gz https://github.com/vision5/ngx_devel_kit/archive/v${VER_NGX_DEVEL_KIT}.tar.gz \
8787
&& tar xvzf /ngx_devel_kit.tar.gz && rm /ngx_devel_kit.tar.gz \
8888
# Lua Nginx Module
8989
# ##############################################################################
90-
&& wget https://github.com/openresty/lua-nginx-module/archive/v${VER_LUA_NGINX_MODULE}.tar.gz -O /lua-nginx.tar.gz \
90+
&& curl -Lo /lua-nginx.tar.gz https://github.com/openresty/lua-nginx-module/archive/v${VER_LUA_NGINX_MODULE}.tar.gz \
9191
&& tar xvzf /lua-nginx.tar.gz && rm /lua-nginx.tar.gz \
9292
# NGINX
9393
# ##############################################################################
@@ -110,10 +110,10 @@ RUN set -x \
110110
make \
111111
mercurial \
112112
openssl-dev \
113-
pcre-dev \
113+
pcre3-dev \
114114
perl-dev \
115115
zlib-dev \
116-
&& wget https://nginx.org/download/nginx-${VER_NGINX}.tar.gz -O /nginx.tar.gz \
116+
&& curl -Lo /nginx.tar.gz https://nginx.org/download/nginx-${VER_NGINX}.tar.gz \
117117
&& tar xvzf /nginx.tar.gz && rm /nginx.tar.gz \
118118
&& cd /nginx-${VER_NGINX} \
119119
&& mkdir -p /var/cache/nginx/client_temp \

‎nginx/1.17.10/alpine/3.11.6/Dockerfile

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -49,45 +49,45 @@ RUN set -x \
4949
&& apk add --no-cache \
5050
geoip-dev \
5151
openssl-dev \
52-
pcre-dev \
52+
pcre3-dev \
5353
zlib-dev \
5454
&& apk add --no-cache --virtual .build-deps \
55+
curl \
5556
g++ \
5657
gzip \
5758
make \
5859
tar \
59-
wget \
6060
# OpenResty LUAJIT2
6161
# ##############################################################################
62-
&& wget https://github.com/openresty/luajit2/archive/v${VER_LUAJIT}.tar.gz -O /luajit.tar.gz \
62+
&& curl -Lo /luajit.tar.gz https://github.com/openresty/luajit2/archive/v${VER_LUAJIT}.tar.gz \
6363
&& tar xvzf /luajit.tar.gz && rm /luajit.tar.gz \
6464
&& cd /luajit2-${VER_LUAJIT} \
6565
&& make -j $(nproc) \
6666
&& make install \
6767
&& cd / \
6868
# LUA Resty Core
6969
# ##############################################################################
70-
&& wget https://github.com/openresty/lua-resty-core/archive/v${VER_LUA_RESTY_CORE}.tar.gz -O /lua-resty-core.tar.gz \
70+
&& curl -Lo /lua-resty-core.tar.gz https://github.com/openresty/lua-resty-core/archive/v${VER_LUA_RESTY_CORE}.tar.gz \
7171
&& tar xvzf /lua-resty-core.tar.gz && rm /lua-resty-core.tar.gz \
7272
&& cd /lua-resty-core-${VER_LUA_RESTY_CORE} \
7373
&& make -j $(nproc) \
7474
&& make install \
7575
&& cd / \
7676
# LUA Resty LRUCache
7777
# ##############################################################################
78-
&& wget https://github.com/openresty/lua-resty-lrucache/archive/v${VER_LUA_RESTY_LRUCACHE}.tar.gz -O /lua-resty-lrucache.tar.gz \
78+
&& curl -Lo /lua-resty-lrucache.tar.gz https://github.com/openresty/lua-resty-lrucache/archive/v${VER_LUA_RESTY_LRUCACHE}.tar.gz \
7979
&& tar xvzf /lua-resty-lrucache.tar.gz && rm /lua-resty-lrucache.tar.gz \
8080
&& cd /lua-resty-lrucache-${VER_LUA_RESTY_LRUCACHE} \
8181
&& make -j $(nproc) \
8282
&& make install \
8383
&& cd / \
8484
# NGX Devel Kit
8585
# ##############################################################################
86-
&& wget https://github.com/vision5/ngx_devel_kit/archive/v${VER_NGX_DEVEL_KIT}.tar.gz -O /ngx_devel_kit.tar.gz \
86+
&& curl -Lo /ngx_devel_kit.tar.gz https://github.com/vision5/ngx_devel_kit/archive/v${VER_NGX_DEVEL_KIT}.tar.gz \
8787
&& tar xvzf /ngx_devel_kit.tar.gz && rm /ngx_devel_kit.tar.gz \
8888
# Lua Nginx Module
8989
# ##############################################################################
90-
&& wget https://github.com/openresty/lua-nginx-module/archive/v${VER_LUA_NGINX_MODULE}.tar.gz -O /lua-nginx.tar.gz \
90+
&& curl -Lo /lua-nginx.tar.gz https://github.com/openresty/lua-nginx-module/archive/v${VER_LUA_NGINX_MODULE}.tar.gz \
9191
&& tar xvzf /lua-nginx.tar.gz && rm /lua-nginx.tar.gz \
9292
# NGINX
9393
# ##############################################################################
@@ -110,10 +110,10 @@ RUN set -x \
110110
make \
111111
mercurial \
112112
openssl-dev \
113-
pcre-dev \
113+
pcre3-dev \
114114
perl-dev \
115115
zlib-dev \
116-
&& wget https://nginx.org/download/nginx-${VER_NGINX}.tar.gz -O /nginx.tar.gz \
116+
&& curl -Lo /nginx.tar.gz https://nginx.org/download/nginx-${VER_NGINX}.tar.gz \
117117
&& tar xvzf /nginx.tar.gz && rm /nginx.tar.gz \
118118
&& cd /nginx-${VER_NGINX} \
119119
&& mkdir -p /var/cache/nginx/client_temp \

‎nginx/1.17.10/alpine/3.12.0/Dockerfile

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -49,45 +49,45 @@ RUN set -x \
4949
&& apk add --no-cache \
5050
geoip-dev \
5151
openssl-dev \
52-
pcre-dev \
52+
pcre3-dev \
5353
zlib-dev \
5454
&& apk add --no-cache --virtual .build-deps \
55+
curl \
5556
g++ \
5657
gzip \
5758
make \
5859
tar \
59-
wget \
6060
# OpenResty LUAJIT2
6161
# ##############################################################################
62-
&& wget https://github.com/openresty/luajit2/archive/v${VER_LUAJIT}.tar.gz -O /luajit.tar.gz \
62+
&& curl -Lo /luajit.tar.gz https://github.com/openresty/luajit2/archive/v${VER_LUAJIT}.tar.gz \
6363
&& tar xvzf /luajit.tar.gz && rm /luajit.tar.gz \
6464
&& cd /luajit2-${VER_LUAJIT} \
6565
&& make -j $(nproc) \
6666
&& make install \
6767
&& cd / \
6868
# LUA Resty Core
6969
# ##############################################################################
70-
&& wget https://github.com/openresty/lua-resty-core/archive/v${VER_LUA_RESTY_CORE}.tar.gz -O /lua-resty-core.tar.gz \
70+
&& curl -Lo /lua-resty-core.tar.gz https://github.com/openresty/lua-resty-core/archive/v${VER_LUA_RESTY_CORE}.tar.gz \
7171
&& tar xvzf /lua-resty-core.tar.gz && rm /lua-resty-core.tar.gz \
7272
&& cd /lua-resty-core-${VER_LUA_RESTY_CORE} \
7373
&& make -j $(nproc) \
7474
&& make install \
7575
&& cd / \
7676
# LUA Resty LRUCache
7777
# ##############################################################################
78-
&& wget https://github.com/openresty/lua-resty-lrucache/archive/v${VER_LUA_RESTY_LRUCACHE}.tar.gz -O /lua-resty-lrucache.tar.gz \
78+
&& curl -Lo /lua-resty-lrucache.tar.gz https://github.com/openresty/lua-resty-lrucache/archive/v${VER_LUA_RESTY_LRUCACHE}.tar.gz \
7979
&& tar xvzf /lua-resty-lrucache.tar.gz && rm /lua-resty-lrucache.tar.gz \
8080
&& cd /lua-resty-lrucache-${VER_LUA_RESTY_LRUCACHE} \
8181
&& make -j $(nproc) \
8282
&& make install \
8383
&& cd / \
8484
# NGX Devel Kit
8585
# ##############################################################################
86-
&& wget https://github.com/vision5/ngx_devel_kit/archive/v${VER_NGX_DEVEL_KIT}.tar.gz -O /ngx_devel_kit.tar.gz \
86+
&& curl -Lo /ngx_devel_kit.tar.gz https://github.com/vision5/ngx_devel_kit/archive/v${VER_NGX_DEVEL_KIT}.tar.gz \
8787
&& tar xvzf /ngx_devel_kit.tar.gz && rm /ngx_devel_kit.tar.gz \
8888
# Lua Nginx Module
8989
# ##############################################################################
90-
&& wget https://github.com/openresty/lua-nginx-module/archive/v${VER_LUA_NGINX_MODULE}.tar.gz -O /lua-nginx.tar.gz \
90+
&& curl -Lo /lua-nginx.tar.gz https://github.com/openresty/lua-nginx-module/archive/v${VER_LUA_NGINX_MODULE}.tar.gz \
9191
&& tar xvzf /lua-nginx.tar.gz && rm /lua-nginx.tar.gz \
9292
# NGINX
9393
# ##############################################################################
@@ -110,10 +110,10 @@ RUN set -x \
110110
make \
111111
mercurial \
112112
openssl-dev \
113-
pcre-dev \
113+
pcre3-dev \
114114
perl-dev \
115115
zlib-dev \
116-
&& wget https://nginx.org/download/nginx-${VER_NGINX}.tar.gz -O /nginx.tar.gz \
116+
&& curl -Lo /nginx.tar.gz https://nginx.org/download/nginx-${VER_NGINX}.tar.gz \
117117
&& tar xvzf /nginx.tar.gz && rm /nginx.tar.gz \
118118
&& cd /nginx-${VER_NGINX} \
119119
&& mkdir -p /var/cache/nginx/client_temp \

‎nginx/1.17.10/amazonlinux/2.0.20200406.0/Dockerfile

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -50,56 +50,55 @@ RUN set -x \
5050
GeoIP-devel \
5151
ca-certificates \
5252
openssl-devel \
53-
pcre-devel \
53+
pcre3-devel \
5454
zlib-devel \
5555
shadow-utils \
5656
&& yum install -y \
5757
gcc-c++ \
5858
gzip \
5959
make \
6060
tar \
61-
wget \
6261
# OpenResty LUAJIT2
6362
# ##############################################################################
64-
&& wget https://github.com/openresty/luajit2/archive/v${VER_LUAJIT}.tar.gz -O /luajit.tar.gz \
63+
&& curl -Lo /luajit.tar.gz https://github.com/openresty/luajit2/archive/v${VER_LUAJIT}.tar.gz \
6564
&& tar xvzf /luajit.tar.gz && rm /luajit.tar.gz \
6665
&& cd /luajit2-${VER_LUAJIT} \
6766
&& make -j $(nproc) \
6867
&& make install \
6968
&& cd / \
7069
# LUA Resty Core
7170
# ##############################################################################
72-
&& wget https://github.com/openresty/lua-resty-core/archive/v${VER_LUA_RESTY_CORE}.tar.gz -O /lua-resty-core.tar.gz \
71+
&& curl -Lo /lua-resty-core.tar.gz https://github.com/openresty/lua-resty-core/archive/v${VER_LUA_RESTY_CORE}.tar.gz \
7372
&& tar xvzf /lua-resty-core.tar.gz && rm /lua-resty-core.tar.gz \
7473
&& cd /lua-resty-core-${VER_LUA_RESTY_CORE} \
7574
&& make -j $(nproc) \
7675
&& make install \
7776
&& cd / \
7877
# LUA Resty LRUCache
7978
# ##############################################################################
80-
&& wget https://github.com/openresty/lua-resty-lrucache/archive/v${VER_LUA_RESTY_LRUCACHE}.tar.gz -O /lua-resty-lrucache.tar.gz \
79+
&& curl -Lo /lua-resty-lrucache.tar.gz https://github.com/openresty/lua-resty-lrucache/archive/v${VER_LUA_RESTY_LRUCACHE}.tar.gz \
8180
&& tar xvzf /lua-resty-lrucache.tar.gz && rm /lua-resty-lrucache.tar.gz \
8281
&& cd /lua-resty-lrucache-${VER_LUA_RESTY_LRUCACHE} \
8382
&& make -j $(nproc) \
8483
&& make install \
8584
&& cd / \
8685
# NGX Devel Kit
8786
# ##############################################################################
88-
&& wget https://github.com/vision5/ngx_devel_kit/archive/v${VER_NGX_DEVEL_KIT}.tar.gz -O /ngx_devel_kit.tar.gz \
87+
&& curl -Lo /ngx_devel_kit.tar.gz https://github.com/vision5/ngx_devel_kit/archive/v${VER_NGX_DEVEL_KIT}.tar.gz \
8988
&& tar xvzf /ngx_devel_kit.tar.gz && rm /ngx_devel_kit.tar.gz \
9089
# Lua Nginx Module
9190
# ##############################################################################
92-
&& wget https://github.com/openresty/lua-nginx-module/archive/v${VER_LUA_NGINX_MODULE}.tar.gz -O /lua-nginx.tar.gz \
91+
&& curl -Lo /lua-nginx.tar.gz https://github.com/openresty/lua-nginx-module/archive/v${VER_LUA_NGINX_MODULE}.tar.gz \
9392
&& tar xvzf /lua-nginx.tar.gz && rm /lua-nginx.tar.gz \
9493
# NGINX
9594
# ##############################################################################
9695
# create nginx user/group first, to be consistent throughout docker variants
97-
&& addgroup -g 1001 -S nginx \
96+
&& groupadd -g 1001 -S nginx \
9897
&& adduser -S -D -H -u 1001 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \
9998
&& yum makecache \
10099
# we're on an architecture upstream doesn't officially build for
101100
# let's build binaries from the published packaging sources
102-
&& wget https://nginx.org/download/nginx-${VER_NGINX}.tar.gz -O /nginx.tar.gz \
101+
&& curl -Lo /nginx.tar.gz https://nginx.org/download/nginx-${VER_NGINX}.tar.gz \
103102
&& tar xvzf /nginx.tar.gz && rm /nginx.tar.gz \
104103
&& cd /nginx-${VER_NGINX} \
105104
&& mkdir -p /var/cache/nginx/client_temp \
@@ -177,13 +176,11 @@ RUN set -x \
177176
gzip \
178177
make \
179178
tar \
180-
wget \
181179
|| rpm -e --nodeps \
182180
gcc-c++ \
183181
gzip \
184182
make \
185-
tar \
186-
wget
183+
tar
187184

188185
HEALTHCHECK --interval=30s --timeout=3s CMD curl --fail http://localhost/ || exit 1
189186

0 commit comments

Comments
 (0)