-
-
Notifications
You must be signed in to change notification settings - Fork 178
[Security] libraries with CVEs that are not used by the project #298
New issue
Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? # to your account
Comments
argh i screwed up testing, creating a new issue |
Investigating in #341 |
It was a regression in Rust, closing this issue out since distroless images are indeed being used now. |
What happened?
A container should be as small as possible with only the necessary libraries to run, so I would like to warn against using a base image such as debian which has a set of libraries that may be necessary for those who use it but which have security flaws already listed in docker.

https://hub.docker.com/layers/library/debian/bullseye-slim/images/sha256-9af4db29e828a4d08c7819f9e0972e2dbdac575e73c6438630c83bd79f49c8aa?context=repo&tab=vulnerabilities
As these libraries are not used by revolt, I implemented distrolless which has other advantages such as being lighter but the main one is security so I strongly recommend using it follow the link to the PR.
#297
The text was updated successfully, but these errors were encountered: