Sandbox image: supported Go and Node versions, installed from verified sources

Open
  • Is something wrong?
#379 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
50/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
bun, docker, go, node.js, python, rust
Domain
devops, documentation, security, testing

Research direction

Start with sandbox/Dockerfile, using the Kotlin toolchain entry as the stated version-and-checksum example; then inspect the four sandbox smoke jobs in .github/workflows/test.yml. Update the toolchain versions and download verification, add the requested support-end-date table to the docs, and update docs/ARCHITECTURE.md. Done means the language tests pass and the image scan has no critical or high fixable Go or Node findings.

Written by the indexing model from the issue text.

Description

area/sandbox dependencies docker

What needs doing

sandbox/Dockerfile installs some language toolchains with a
command, not from the base image:

  • Node.js 20, by a setup script that is piped into a shell.
  • Go 1.22.10, by an archive that is unpacked with no checksum check.
  • Rust and Bun, each by an install script that is piped into a
    shell; Rust takes whatever "stable" is on the day of the build.

Kotlin in the same file shows the pattern to follow: a fixed
version, and the download held against a recorded checksum.

  1. Move Go and Node to versions that still get fixes. Go 1.22 and
    Node 20 are both past their end of support.
  2. Check the Go archive against its published checksum.
  3. Install Node from a pinned source, not from a script piped into a
    shell. Do the same for Rust and Bun, or say in the file why not.
  4. Add a table to the docs: each toolchain in the image, its
    version, and the date its support ends.

Why

A tool that a Dockerfile installs by a command is not updated by
Dependabot, so it stays at its version until someone looks. The
weekly image scan now names findings in these two toolchains that
newer versions have fixed.

Done when

  • The image scan shows no critical or high finding with a fix in
    the Go and Node toolchains.
  • Every download in sandbox/Dockerfile is a fixed version held
    against a checksum, or has its reason beside it.
  • The sandbox's language tests pass.
  • The table is in the docs, and docs/ARCHITECTURE.md names the
    new versions.

Where to start

  • sandbox/Dockerfile; the four sandbox smoke jobs in
    .github/workflows/test.yml.
  • No GPU or model is needed.
Dominant language
Python
Stars
2.1k
Forks
197
Avg merge
5h 54m
Merged PRs (30d)
510

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from inferstep/ATLAS

All issues in inferstep/ATLAS

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.