From 29125f8e938d4ef8c29cb880de0c6825b884ff3d Mon Sep 17 00:00:00 2001 From: nscuro Date: Wed, 23 Sep 2026 13:39:36 +0200 Subject: [PATCH 1/4] chore: bump distroless base image resolve high severity cve The Trivy actions is currently failing due to CVE-2026-14456. Bumping the base image digest resolves it. Signed-off-by: nscuro --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index e995880..498dc58 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ RUN go mod download && \ ls -ltr /netassertv2 # gcr.io/distroless/base:nonroot -FROM gcr.io/distroless/base@sha256:97b9d04bed1c754b756c3c4b6a04915c22fb0b5d96a59944eb3bf78c26e6e157 +FROM gcr.io/distroless/base@sha256:0896741ba5bafd3ac87ea025a5f578952f2d238ddc3614cb368acc983a687aa2 COPY --from=builder /netassertv2 /usr/bin/netassertv2 ENTRYPOINT [ "/usr/bin/netassertv2" ] From 138fbbb6ebd68199b3930bd91f02aaa91cac1cc6 Mon Sep 17 00:00:00 2001 From: G Baggio <121507638+g-bgg@users.noreply.github.com> Date: Mon, 5 Oct 2026 15:59:45 +0200 Subject: [PATCH 2/4] use static nonroot in Dockerfile --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 498dc58..cf2c34e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ RUN go mod download && \ ls -ltr /netassertv2 # gcr.io/distroless/base:nonroot -FROM gcr.io/distroless/base@sha256:0896741ba5bafd3ac87ea025a5f578952f2d238ddc3614cb368acc983a687aa2 +FROM gcr.io/distroless/static:nonroot@sha256:e2e927ec666bae08560abb3c55d0659eceabb657f56b6782ab500a9fc7f555e3 COPY --from=builder /netassertv2 /usr/bin/netassertv2 ENTRYPOINT [ "/usr/bin/netassertv2" ] From 0c490826be5ddf00396e70d93e89cde5f3f8e2ce Mon Sep 17 00:00:00 2001 From: G Baggio <121507638+g-bgg@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:21:26 +0200 Subject: [PATCH 3/4] Dockerfile bring image name comment inline --- Dockerfile | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index cf2c34e..70f5569 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,4 @@ -# golang:1.26.6-alpine3.24 -FROM golang@sha256:3889b425f035be855a72fb4755265311293b6d414521f0a519d819df32222d83 AS builder +FROM golang@sha256:3889b425f035be855a72fb4755265311293b6d414521f0a519d819df32222d83 AS builder # golang:1.26.6-alpine3.24 ARG VERSION ARG SCANNER_IMG_VERSION @@ -12,8 +11,7 @@ RUN go mod download && \ CGO_ENABLED=0 GO111MODULE=on go build -ldflags="-X 'main.appName=NetAssert' -X 'main.version=${VERSION}' -X 'main.scannerImgVersion=${SCANNER_IMG_VERSION}' -X 'main.snifferImgVersion=${SNIFFER_IMG_VERSION}'" -v -o /netassertv2 cmd/netassert/cli/*.go && \ ls -ltr /netassertv2 -# gcr.io/distroless/base:nonroot -FROM gcr.io/distroless/static:nonroot@sha256:e2e927ec666bae08560abb3c55d0659eceabb657f56b6782ab500a9fc7f555e3 +FROM gcr.io/distroless/static:nonroot@sha256:e2e927ec666bae08560abb3c55d0659eceabb657f56b6782ab500a9fc7f555e3 # gcr.io/distroless/base:nonroot COPY --from=builder /netassertv2 /usr/bin/netassertv2 ENTRYPOINT [ "/usr/bin/netassertv2" ] From 1f3ed1d3b53056eeb40b5941e87b19c94789e677 Mon Sep 17 00:00:00 2001 From: G Baggio <121507638+g-bgg@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:30:32 +0200 Subject: [PATCH 4/4] Update Dockerfile --- Dockerfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 70f5569..e4bfc22 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,5 @@ -FROM golang@sha256:3889b425f035be855a72fb4755265311293b6d414521f0a519d819df32222d83 AS builder # golang:1.26.6-alpine3.24 +# golang:1.26.6-alpine3.24 +FROM golang@sha256:3889b425f035be855a72fb4755265311293b6d414521f0a519d819df32222d83 AS builder ARG VERSION ARG SCANNER_IMG_VERSION @@ -11,7 +12,8 @@ RUN go mod download && \ CGO_ENABLED=0 GO111MODULE=on go build -ldflags="-X 'main.appName=NetAssert' -X 'main.version=${VERSION}' -X 'main.scannerImgVersion=${SCANNER_IMG_VERSION}' -X 'main.snifferImgVersion=${SNIFFER_IMG_VERSION}'" -v -o /netassertv2 cmd/netassert/cli/*.go && \ ls -ltr /netassertv2 -FROM gcr.io/distroless/static:nonroot@sha256:e2e927ec666bae08560abb3c55d0659eceabb657f56b6782ab500a9fc7f555e3 # gcr.io/distroless/base:nonroot +# gcr.io/distroless/static:nonroot +FROM gcr.io/distroless/static:nonroot@sha256:e2e927ec666bae08560abb3c55d0659eceabb657f56b6782ab500a9fc7f555e3 COPY --from=builder /netassertv2 /usr/bin/netassertv2 ENTRYPOINT [ "/usr/bin/netassertv2" ]