hasura / hasura/graphql-engine

Docker image contains vulnerabilities according to Trivy

Open
#7,489 7 comments 0 reactions 0 assignees View on GitHub
c/build-system
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

When scanning the latest v2.0.8 image using [Trivy container image scanner](https://github.com/aquasecurity/trivy)
A total of 617 issues are reported, as opposed to 0 in the old v1.3.3 image.

```
➜ ~ trivy image hasura/graphql-engine:v2.0.8
2021-09-02T09:26:36.465+0200 INFO Detected OS: debian
2021-09-02T09:26:36.465+0200 INFO Detecting Debian vulnerabilities...
2021-09-02T09:26:36.491+0200 INFO Number of language-specific files: 0

hasura/graphql-engine:v2.0.8 (debian 10.9)
==========================================
Total: 617 (UNKNOWN: 0, LOW: 449, MEDIUM: 70, HIGH: 82, CRITICAL: 16)
```

Perhaps the engine is built on a new lesser base image? (I'm no container expert)

I've attached the Trivy report output as a file rather than pasting it, as it's quite large.
[trivy-output.txt](https://github.com/hasura/graphql-engine/files/7096947/trivy-output.txt)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.