aws / aws/aws-lambda-base-images
python:3.8 base image has suspicious python package already installed
Open
python
- Dominant language
- No language data
- Stars
- 777
- Forks
- 118
- PR merge metrics
- No merged PRs in 30d
Description
Build an image using this simple Dockerfile:
```
FROM public.ecr.aws/lambda/python:3.8
ENTRYPOINT ["tail", "-f", "/dev/null"]
```
And then execute `pip freeze` inside the container
```
docker build -t test_app .
docker run -d --name test test_app
docker exec test pip freeze
```
Will show that there's a suspicious-looking package installed:
`rapid_client==0.0.0`
Since I have done nothing in the Dockerfile, it appears to be that package is somehow installed in the base image itself. Although the package in question seems to be empty from PyPI, it's still a risk and should be removed.
Contributor guide
Assessment
This issue has not been assessed yet.