Propral: additional base image `amazonlinux:2023`
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- docker, linux, python
- Domain
- devops, infrastructure
Research direction
The issue names no files or tests. Start by reviewing the repository's current Python image definitions and how base images are selected, then assess whether amazonlinux:2023 can be supported consistently. Done would require a maintainer decision on ownership, support scope, and the required image changes.
Written by the indexing model from the issue text.
Description
Hey guys, first of all, thank you for the work you are doing 🙏
Docker images of python are being shipped millions of times per month (if not per day), and that's awesome 💪
As you most likely know, there is a CVE affecting MiniZip shipped with zlib affecting Debian (buster, bullseye, and bookworm): https://security-tracker.debian.org/tracker/CVE-2023-45853.
I am aware that this vulnerability is effectively impacting minizip (and not really the actual libz binary, which is the one that matters here).
This is CVE is being considered as critical by my company docker image scanner, so we've been trying to find ways to get rid of these secrutiy alerts, and, as a temporrary solution, we decided to switch from python:3.X base image, to a amazonlinux:2023[-minimal] with python3.11 installed there (version maitained by amazon).
Using Amazon Linux 2023 is removing this security alert as amazon backported the fix in its libz (c.f. Amazon document ALAS-2023-410) as the version 1.2.11-33.amzn2023.0.5.
Based on the context above, did this community though of adding amazonlinux:2023 as a base image of python images, to benefit from latest security releases?
Or maybe should it be the responsability of amazon to create such image (like they are doing with amazoncoretto)?
Cheers ✌️
This issue is not necessarily asking to support amazonlinux as a base image, but it's to open a discussion on that matter (and based on the issues of this repository, no one already brought it yet)
- Dominant language
- Dockerfile
- Stars
- 2.8k
- Forks
- 1.1k
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker-library/python
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
docker-library/python#1080 · 8 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
docker-library/python#1121 · 2 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
docker-library/python#1082 · 10 comments · 36 reactions ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
docker-library/python#1076 · 6 comments · 1 reaction ·
-
Difficulty 3/5 1-2 days Newbie friendliness 52/100
docker-library/python#1071 · 7 comments ·
All issues in docker-library/python
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
vicharanashala/fln#564 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
haskell-actions/setup#152 ·
-
feature-request helm
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gravitational/teleport#69785 ·
-
A cancelled tests run makes the coverage comment workflow fail and reports it as a red check on main Openarea: ci bug perceived difficulty: 3
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Nitjsefnie-Harness-Commons/daedalus#921 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
TencentCloud/Octop#1007 ·