aws / aws/aws-lambda-base-images

python:3.8 base image has suspicious python package already installed

Open
#50 0 comments 0 reactions 0 assignees View on GitHub
python
Dominant language
No language data
Stars
777
Forks
118
PR merge metrics
No merged PRs in 30d

Description

Build an image using this simple Dockerfile:

```
FROM public.ecr.aws/lambda/python:3.8
ENTRYPOINT ["tail", "-f", "/dev/null"]
```

And then execute `pip freeze` inside the container
```
docker build -t test_app .
docker run -d --name test test_app
docker exec test pip freeze
```

Will show that there's a suspicious-looking package installed:

`rapid_client==0.0.0`

Since I have done nothing in the Dockerfile, it appears to be that package is somehow installed in the base image itself. Although the package in question seems to be empty from PyPI, it's still a risk and should be removed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.