hasura / hasura/graphql-engine
Docker image contains vulnerabilities according to Trivy
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
When scanning the latest v2.0.8 image using [Trivy container image scanner](https://github.com/aquasecurity/trivy)
A total of 617 issues are reported, as opposed to 0 in the old v1.3.3 image.
```
➜ ~ trivy image hasura/graphql-engine:v2.0.8
2021-09-02T09:26:36.465+0200 INFO Detected OS: debian
2021-09-02T09:26:36.465+0200 INFO Detecting Debian vulnerabilities...
2021-09-02T09:26:36.491+0200 INFO Number of language-specific files: 0
hasura/graphql-engine:v2.0.8 (debian 10.9)
==========================================
Total: 617 (UNKNOWN: 0, LOW: 449, MEDIUM: 70, HIGH: 82, CRITICAL: 16)
```
Perhaps the engine is built on a new lesser base image? (I'm no container expert)
I've attached the Trivy report output as a file rather than pasting it, as it's quite large.
[trivy-output.txt](https://github.com/hasura/graphql-engine/files/7096947/trivy-output.txt)
Contributor guide
Assessment
This issue has not been assessed yet.