apache / apache/age

The image contains 4 high vulnerabilitiesDocker DX (docker-language-server)(critical_high_vulnerabilities)

Open
#2,247 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C
Stars
4.8k
Forks
523
Avg merge
1d 2h
Merged PRs (30d)
9

Description

**Describe the bug**

The Docker image `apache/age:release_PG17_1.6.0` contains 4 high security vulnerabilities, which poses a security risk when used in production environments.

**How are you accessing AGE (Command line, driver, etc.)?**

- Docker image

**What data setup do we need to do?**

N/A - This is a base image security issue, not related to data setup.

**What is the necessary configuration info needed?**

- Using the official Apache AGE Docker image: `apache/age:release_PG17_1.6.0`
- Docker image scanning reveals: 0 Critical, 4 High, 9 Medium, 29 Low vulnerabilities

**What is the command that caused the error?**

```dockerfile
FROM apache/age:release_PG17_1.6.0
```

When scanning the image with Docker security tools, the following vulnerabilities are detected:

```
Current image vulnerabilities: 0C 4H 9M 29L
```

**Expected behavior**

The base Docker image should be regularly updated to patch known security vulnerabilities. The image should have minimal or no high-severity vulnerabilities, especially for production use.

**Environment (please complete the following information):**

- Version: `apache/age:release_PG17_1.6.0`
- PostgreSQL Version: 17
- AGE Version: 1.6.0

**Additional context**

This issue affects anyone using the official Apache AGE Docker image as a base image. The vulnerabilities should be addressed by:
1. Updating base packages in the image
2. Rebuilding and publishing a new image version with security patches
3. Providing regular security updates for the Docker image

The Dockerfile in question:
```dockerfile
FROM apache/age:release_PG17_1.6.0
ARG PG_MAJOR=17

ADD https://github.com/pgvector/pgvector.git#v0.8.1 /tmp/pgvector

RUN apt-get update && \
apt-mark hold locales && \
apt-get install -y --no-install-recommends build-essential postgresql-server-dev-$PG_MAJOR && \
cd /tmp/pgvector && \
make clean && \
make OPTFLAGS="" && \
make install && \
mkdir /usr/share/doc/pgvector && \
cp LICENSE README.md /usr/share/doc/pgvector && \
rm -r /tmp/pgvector && \
apt-get remove -y build-essential postgresql-server-dev-$PG_MAJOR && \
apt-get autoremove -y && \
apt-mark unhold locales && \
rm -rf /var/lib/apt/lists/*
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.