HumanSignal / HumanSignal/label-studio

Switch to Docker Hardened Images (DHI) for base images in `Dockerfile`

Open
#9,620 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
TypeScript
Stars
28.3k
Forks
3.7k
Avg merge
14h
Merged PRs (30d)
15

Description

We use Label Studio's official Docker images as a base (via FROM) and apply some modifications on top. However, we keep running into vulnerabilities when we scan these images.

I believe the root cause is that Label Studio's Docker image uses the standard python image from Docker Hub as its base. Switching to [Docker Hardened Images](https://www.docker.com/products/hardened-images/) (DHI) instead would likely resolve these vulnerabilities. DHI are now free and open source, released under the Apache 2.0 license.

I'd be happy to open a Pull Request to make this change, but there's one thing to be aware of: pulling DHI requires authentication with a Docker Hub account, so you would need to configure that on your end as well.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.