That sounds like a fine fix. In general this problem is just a mess.

On Tue, May 3, 2016 at 11:18 AM, Aaron Levy notifications@github.com
wrote:

It looks like some packages in the hyperkube image contain security
issues. This is based on a scan of the container using
https://github.com/coreos/clair

I just pulled the gcr.io/google_containers/hyperkube:v1.2.3 image, then
pushed it to the quay.io registry to be scanned, and this is the output:

https://quay.io/repository/aaron_levy/hyperkube/image/04355a9c966dafc9d29c96a79112ea527f42fa8654231f9730b12895b6fbdef3?tab=vulnerabilities

When building the coreos-hyperkube image, we have been adding an apt-get
upgrade step to ensure we are updating packages already in the base image:

https://github.com/coreos/kubernetes/blob/coreos-hyperkube-v1.2.3/coreos/Dockerfile#L13

And that has been sufficient to cover the issues that have been patched
upstream:

https://quay.io/repository/coreos/hyperkube/image/a83cfe2b9e56e2b9343f1986a81d4d0c3d888f6b3cf53d1f141ea500efa8d205?tab=vulnerabilities

As a possible solution I can add a PR to make the same upstream change -
or we could be more specific and just update the individual packages
identified.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub
#25097