From e3130d5731d499dbd85d1f9e8196ab1e62d4cc69 Mon Sep 17 00:00:00 2001
From: Johan Kumps <johan.kumps@nccn.fgov.be>
Date: Wed, 10 Jan 2024 18:45:58 +0100
Subject: [PATCH] Upgrade base image + upgrade librarties fixing critical and
 high CVE issues

---
 admin-ui/Dockerfile                  | 2 +-
 admin-ui/pom.xml                     | 4 ++--
 knowledge-directory/Dockerfile       | 2 +-
 knowledge-directory/pom.xml          | 4 ++--
 smart-connector-rest-dist/Dockerfile | 9 ++++++++-
 smart-connector-rest-server/pom.xml  | 4 ++--
 smart-connector/pom.xml              | 2 +-
 7 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/admin-ui/Dockerfile b/admin-ui/Dockerfile
index bc7f59c1d..4caf48430 100644
--- a/admin-ui/Dockerfile
+++ b/admin-ui/Dockerfile
@@ -1,4 +1,4 @@
-FROM eclipse-temurin:17
+FROM eclipse-temurin:21-alpine
 LABEL org.opencontainers.image.source https://github.com/tno/knowledge-engine
 LABEL org.opencontainers.image.description="Knowledge Engine: Admin UI"
 LABEL org.opencontainers.image.licenses=Apache-2.0
diff --git a/admin-ui/pom.xml b/admin-ui/pom.xml
index 570a3c6e1..dc97ccb59 100644
--- a/admin-ui/pom.xml
+++ b/admin-ui/pom.xml
@@ -14,10 +14,10 @@
 	<description>A user interface for managing a Knowledge Network.</description>
 
 	<properties>
-		<swagger-core-version>1.5.18</swagger-core-version>
+		<swagger-core-version>1.6.12</swagger-core-version>
 		<jetty-version>9.4.51.v20230217</jetty-version>
 		<jersey2-version>2.34</jersey2-version>
-		<jackson-version>2.9.9</jackson-version>
+		<jackson-version>2.16.1</jackson-version>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	</properties>
 
diff --git a/knowledge-directory/Dockerfile b/knowledge-directory/Dockerfile
index 830ec0f49..b507e577c 100644
--- a/knowledge-directory/Dockerfile
+++ b/knowledge-directory/Dockerfile
@@ -1,4 +1,4 @@
-FROM eclipse-temurin:17
+FROM eclipse-temurin:21-alpine
 LABEL org.opencontainers.image.source https://github.com/tno/knowledge-engine
 LABEL org.opencontainers.image.description="Knowledge Engine: Knowledge Directory"
 LABEL org.opencontainers.image.licenses=Apache-2.0
diff --git a/knowledge-directory/pom.xml b/knowledge-directory/pom.xml
index b630a1a88..cc81759fb 100644
--- a/knowledge-directory/pom.xml
+++ b/knowledge-directory/pom.xml
@@ -14,11 +14,11 @@
 
 	<properties>
 		<!-- TODO move some of these to ke-parent -->
-		<swagger-core-version>1.5.18</swagger-core-version>
+		<swagger-core-version>1.6.12</swagger-core-version>
 		<beanvalidation-version>1.1.0.Final</beanvalidation-version>
 		<jetty-version>9.4.51.v20230217</jetty-version>
 		<jersey2-version>2.35</jersey2-version>
-		<jackson-version>2.9.9</jackson-version>
+		<jackson-version>2.16.1</jackson-version>
 		<junit-version>4.13.1</junit-version>
 		<logback-version>1.1.7</logback-version>
 		<servlet-api-version>4.0.1</servlet-api-version>
diff --git a/smart-connector-rest-dist/Dockerfile b/smart-connector-rest-dist/Dockerfile
index 00dd685c2..bca11501e 100644
--- a/smart-connector-rest-dist/Dockerfile
+++ b/smart-connector-rest-dist/Dockerfile
@@ -1,4 +1,4 @@
-FROM eclipse-temurin:17
+FROM eclipse-temurin:21-alpine
 LABEL org.opencontainers.image.source https://github.com/tno/knowledge-engine
 LABEL org.opencontainers.image.description="Knowledge Engine: Smart Connector (with HTTP API)"
 LABEL org.opencontainers.image.licenses=Apache-2.0
@@ -8,6 +8,13 @@ ARG JAR_FILE=target/*-with-dependencies.jar
 # Copy the jar in a single directory
 COPY ${JAR_FILE} /knowledge_engine/knowledge-engine.jar
 
+# Make sure files/folders needed by the processes are accessable when they run under the nobody user
+RUN chown -R nobody /knowledge_engine
+
+# Switch to use a non-root user from here on
+# Use uid of nobody user (65534) because kubernetes expects numeric user when applying pod security policies
+USER 65534
+
 EXPOSE 8280
 
 # Add that directory to the class path.
diff --git a/smart-connector-rest-server/pom.xml b/smart-connector-rest-server/pom.xml
index e5e865935..f68a21e29 100644
--- a/smart-connector-rest-server/pom.xml
+++ b/smart-connector-rest-server/pom.xml
@@ -11,10 +11,10 @@
 	</parent>
 
 	<properties>
-		<swagger-core-version>1.5.18</swagger-core-version>
+		<swagger-core-version>1.6.12</swagger-core-version>
 		<jetty-version>9.4.51.v20230217</jetty-version>
 		<jersey2-version>2.35</jersey2-version>
-		<jackson-version>2.9.9</jackson-version>
+		<jackson-version>2.16.1</jackson-version>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 	</properties>
 
diff --git a/smart-connector/pom.xml b/smart-connector/pom.xml
index 388ea4022..8062fa439 100644
--- a/smart-connector/pom.xml
+++ b/smart-connector/pom.xml
@@ -179,7 +179,7 @@
 		<swagger-core-version>1.5.18</swagger-core-version>
 		<jersey2-version>2.35</jersey2-version>
 		<servlet-api-version>4.0.1</servlet-api-version>
-		<jackson-version>2.9.9</jackson-version>
+		<jackson-version>2.16.1</jackson-version>
 	</properties>
 
 	<build>