alternative to gosu to ensure even naïve vulnerability scanners show no false-positives
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
Research direction
Start by reviewing the linked postgres issues and the gosu repository discussion, then compare possible replacements for gosu in the postgres image. A satisfactory result must provide the same functionality, remain actively maintained for security fixes, and avoid the reported false positives in Docker Scout and Trivy.
Written by the indexing model from the issue text.
Description
Happy new year 🥂, sorry to rip up in the discussions provided here and in the gosu repository:
https://github.com/docker-library/postgres/issues/1292
https://github.com/docker-library/postgres/issues/1282
https://github.com/docker-library/postgres/issues/1297
While I completely respect and understand the stance of gosu author that vulnerability scanners are naïve and show false positive, I think that much time is wasted by postgres consumers understanding all the details and even move time is spent explaining that the critical issues in postgresql images are false positives.
Therefore this (another thread) on the subject. However the question I would like to ask here is
- Do you know of a replacement for gosu which can be used and give postresql project the same functionality?
the alternative MUST be actively maintained, in the way that all security issues are actively addressed in a way that even naïve vulnerabiltity scanners understand (at least docker scout and trivy)
Please let's focus this discussion on alternatives to gosu in this image.For comments that mention to fix gosu itself, make those comments in the gosu project.
- Dominant language
- Shell
- Stars
- 2.5k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker-library/postgres
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
docker-library/postgres#1420 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
docker-library/postgres#1419 · 2 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
docker-library/postgres#1389 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
docker-library/postgres#1356 · 5 comments · 7 reactions ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
docker-library/postgres#1355 · 10 comments · 11 reactions ·
All issues in docker-library/postgres
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
community-scripts/ProxmoxVE#17425 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
danielmiessler/LifeOS#2218 ·
-
agent-research-recommend agent-review-finding
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
jordansmall/spindrift#3714 · 1 comment ·