Skip to content

chore: apply security recommendations #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
masterjanic merged 1 commit into from
Oct 9, 2026
Merged

chore: apply security recommendations #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# syntax=docker/dockerfile:1
FROM --platform=$BUILDPLATFORM golang:1.27-trixie AS build
# Base images are pinned by digest; Renovate updates them.
FROM --platform=$BUILDPLATFORM golang:1.27-trixie@sha256:2f84bc93ecfb2689f782b153fdcd368b5a7ab96c1386c65cdaccf35e726d6a44 AS build
ARG TARGETOS TARGETARCH VERSION=dev
WORKDIR /src
COPY go.mod go.sum ./
Expand All @@ -10,10 +11,12 @@ RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -trimpath \
-ldflags "-s -w -X github.com/virtbase/proxbase/internal/cli.version=${VERSION}" \
-o /out/proxbase ./cmd/proxbase

FROM debian:trixie-slim
FROM debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
# Extra apt options for difficult networks, e.g. --build-arg APT_OPTS="-o Acquire::ForceIPv4=true"
ARG APT_OPTS=""
# upgrade: security fixes released after the base image
RUN apt-get update $APT_OPTS \
&& apt-get upgrade -y -o Acquire::Retries=3 $APT_OPTS \
&& apt-get install -y --no-install-recommends -o Acquire::Retries=3 $APT_OPTS qemu-system-x86 qemu-utils ca-certificates openssh-client tini \
&& rm -rf /var/lib/apt/lists/*
# Runs as uid 1000; /dev/kvm access comes from the host (group_add the kvm GID).
Expand Down
5 changes: 4 additions & 1 deletion Dockerfile.release
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,12 @@
# Image built by GoReleaser from the release binaries (see Dockerfile for source builds).
FROM debian:trixie-slim
# The base image is pinned by digest; Renovate updates it.
FROM debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
ARG TARGETPLATFORM
# Extra apt options for difficult networks, e.g. --build-arg APT_OPTS="-o Acquire::ForceIPv4=true"
ARG APT_OPTS=""
# upgrade: security fixes released after the base image
RUN apt-get update $APT_OPTS \
&& apt-get upgrade -y -o Acquire::Retries=3 $APT_OPTS \
&& apt-get install -y --no-install-recommends -o Acquire::Retries=3 $APT_OPTS qemu-system-x86 qemu-utils ca-certificates openssh-client tini \
&& rm -rf /var/lib/apt/lists/*
RUN useradd --uid 1000 --create-home proxbase && mkdir -p /data && chown proxbase:proxbase /data
Expand Down
6 changes: 6 additions & 0 deletions osv-scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
# Known vulnerabilities that do not affect Proxbase (read by OSV-Scanner and the
# OpenSSF Scorecard). Review when golang.org/x/crypto changes.

[[IgnoredVulns]]
id = "GO-2026-5932"
reason = "Affects golang.org/x/crypto/openpgp, which Proxbase does not import; govulncheck reports it as not called. The package is deprecated and has no fixed version."
Loading