Skip to content

Fix CVEs by removing unused OS packages and updating dependencies #545

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
moshemorad merged 4 commits into from
Jul 27, 2026
+129 −110
Merged

Fix CVEs by removing unused OS packages and updating dependencies #545

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e8a5422
Patch CRITICAL/HIGH CVEs in krr image and dependencies
claude Jul 27, 2026
28a58e0
Document uuid fallback and k8s mount semantics in purge layer
claude Jul 27, 2026
66e05db
Trim verbose comments in Dockerfile and pyproject.toml
claude Jul 27, 2026
dd66618
Use dpkg-query Status-Status for purge verification
claude Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,5 +24,25 @@ COPY ./krr.py krr.py
COPY ./robusta_krr/ robusta_krr/
COPY ./intro.txt intro.txt

# Remove unused OS packages with unfixed CVEs (perl-base: 4 CRITICAL; util-linux
# family: HIGH). dpkg exits non-zero on essential-package warnings even on
# success, so removals and runtime sanity are verified explicitly instead.
RUN dpkg --purge --force-remove-essential --force-depends \
perl-base \
util-linux bsdutils mount \
libmount1 libblkid1 libsmartcols1 liblastlog2-2 libuuid1 \
; rm -rf /var/lib/apt/lists/* \
&& for p in perl-base util-linux bsdutils mount libmount1 libblkid1 \
libsmartcols1 liblastlog2-2 libuuid1; do \
status="$(dpkg-query -W -f='${db:Status-Status}' "$p" 2>/dev/null || true)"; \
if [ -n "$status" ] && [ "$status" != "not-installed" ]; then \
echo "ERROR: $p was not removed (status: $status)" >&2; exit 1; \
fi; \
Comment thread
moshemorad marked this conversation as resolved.
done \
&& python -c "import robusta_krr" \
&& python -c "import uuid; uuid.uuid4(); uuid.uuid1(); uuid.getnode()" \
&& bash -c 'echo bash-ok' \
&& echo "purge verified"

# Run the application using 'poetry run krr simple'
CMD ["python", "krr.py", "simple"]
Loading
Loading