Skip to content

Commit

Permalink
Remove linux-libc-dev to avoid false-positives.
Browse files Browse the repository at this point in the history
Container scans generate hundreds of findings on linux-libc-dev, even
though the package only contains headers. These headers aren't needed
anyway, so we remove them to eliminate the false-positives.
  • Loading branch information
ZoogieZork committed Nov 4, 2024
1 parent aa34df7 commit bc2020c
Showing 1 changed file with 6 additions and 4 deletions.
10 changes: 6 additions & 4 deletions backend/Dockerfiles/Dockerfile.ruby
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,15 @@ ARG BUNDLER_VER=0.9.2
# Run all additional config in a single RUN to reduce the layers:
# - Install brakeman and bundler-audit
# - Install git as a dependency of bundler-audit.
# - Remove bundler-audit rspec Gemfiles to avoid false-positives in scans.
# - Remove unused packages and bundler-audit rspec Gemfiles to avoid
# false-positives in scans.
# hadolint ignore=DL3008
RUN apt-get update && \
apt-get upgrade -y && \
apt-get install -y --no-install-recommends git && \
apt-get clean && \
rm -rf /var/lib/apt/lists/* && \
gem install brakeman --version ${BRAKEMAN_VER} && \
gem install bundler-audit --version ${BUNDLER_VER} && \
rm -rf /usr/local/bundle/gems/bundler-audit-${BUNDLER_VER}/spec/
rm -rf /usr/local/bundle/gems/bundler-audit-${BUNDLER_VER}/spec/ && \
apt-get remove -y linux-libc-dev && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*

0 comments on commit bc2020c

Please sign in to comment.