High number of vulnerabilities due to outdated baseimage

Seafile Docker images MUST be rebuild whenever a base image is rebuild to fix a vulnerability. Although many of these are most likely not exploitable it looks like being more easy to rebuild the docker image regularly to include the patches than checking each of these by hand and looking for new ones on a regular basis.

2 Likes

Is seafile still not using autobuild?

No. Also using autobuilds on Docker Hub would not fix this issue and also would not work because they use their own registry.

From my point of view currently the best solution would be to setup a scheduled rebuild for important images and tags and push them whenever the resulting image changes. E.g. rebuild the base images at 1am and rebuild the latest images at 3 am. It also could be useful to run some automated tests prior to pushing the images.

2 Likes