Skip to content

Updates for ubuntu:latest, python 3.10, werkzeug 2.3.7, remove meinheld#31

Merged
pmalek merged 3 commits intoKong:mainfrom
matt-domsch-sp:modernize
Sep 13, 2023
Merged

Updates for ubuntu:latest, python 3.10, werkzeug 2.3.7, remove meinheld#31
pmalek merged 3 commits intoKong:mainfrom
matt-domsch-sp:modernize

Conversation

@matt-domsch-sp
Copy link
Copy Markdown
Contributor

@matt-domsch-sp matt-domsch-sp commented Sep 10, 2023 •
edited
Loading

Summary

Due to 441 reported CVEs in the docker.io/kong/httpbin:latest image
(Ubuntu focal packages and python libraries), I found it necessary to update the base OS to
ubuntu:latest. Doing so brings in Python 3.10 and updated pipenv. To
resolve the python library CVEs, update the dependencies which include
werkzeug 2.3.7 which necessitates a few minor changes to the
application. Removing (unused) meinheld resolves another CVE.

Full changelog

  • Use ubuntu:latest as base image, with all current updates applied
  • Use Python 3.10 from base image in a pipenv
  • Upgrade python library dependencies

Testing

  • Unit tests
  • E2E tests

CVEs addressed

@matt-domsch-sp matt-domsch-sp requested a review from a team as a code owner September 10, 2023 15:25
@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Sep 10, 2023 •
edited
Loading

CLA assistant check
All committers have signed the CLA.

pmalek
pmalek reviewed Sep 11, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@pmalek pmalek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for submitting this PR. I've tested it locally and it seems that the basic functionality is still there.

I left just one small nit comment which I believe might be worth addressing.

Comment thread Dockerfile Outdated
@matt-domsch-sp
Copy link
Copy Markdown
Contributor Author

matt-domsch-sp commented Sep 13, 2023

I have addressed the version, and not invoked the unit test in the Docker build. I also confirm that this image no longer reports any vulnerabilities by the Wiz scanning tool.

Thanks,
Matt

@pmalek pmalek added dependencies Pull requests that update a dependency file docker Pull requests that update Docker code labels Sep 13, 2023
@pmalek
Copy link
Copy Markdown
Member

pmalek commented Sep 13, 2023

@matt-domsch-sp Do you mind rebasing? I've fixed the broken precommit workflow in #37.

@matt-domsch-sp
Updates for ubuntu:latest, python 3.10, werkzeug 2.3.7
e34e25a 
Due to 441 reported CVEs in this image (Ubuntu focal packages and
python libraries), I found it necessary to update the base OS to
ubuntu:latest. Doing so brings in Python 3.10 and updated pipenv. To
resolve the python library CVEs, update the dependencies which include
werkzeug 2.3.7 which necessitates a few minor changes to the
application.
@matt-domsch-sp
remove meinheld
2762c1b 
The meinheld library is no longer needed to run gunicorn, and it has
a medium CVE reported against it. Upgrading gunicorn to latest and
removing meinheld library will resolve this.
@matt-domsch-sp
Use ubuntu:jammy-20230816
80252f4
@matt-domsch-sp
Copy link
Copy Markdown
Contributor Author

matt-domsch-sp commented Sep 13, 2023

rebased onto main.

@programmer04 programmer04 requested a review from pmalek September 13, 2023 16:17
pmalek
pmalek approved these changes Sep 13, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@pmalek pmalek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for improving this!

I believe you can submit this form for a contributor's T-shirt: https://docs.google.com/forms/d/e/1FAIpQLSfacQHac-PYIDIrDOi_W2l7cWxBDRIVBs6xE5HnlojPvdhL9g/viewform.

It'd be super cool to actually run those tests on CI (not during the image building stage). If you're up for it feel free to submit a PR with that change.

@pmalek pmalek merged commit 5f90f9f into Kong:main Sep 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pmalek pmalek pmalek approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file docker Pull requests that update Docker code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@matt-domsch-sp @CLAassistant @pmalek