Container Solution - CVE Fix - Prometheus-operator

docker/prometheus-operator/0/debian12/0.77/Dockerfile

@@ -8,7 +8,7 @@ RUN git clone https://github.com/prometheus-operator/prometheus-operator.git /sr
     && cd /src/prometheus-operator/ \
     && git checkout $PROMETHEUS_OPERATOR_VERSION
 
-FROM docker.io/golang as builder
+FROM docker.io/library/golang:1.25-bookworm as builder
 
 COPY --from=git /src/prometheus-operator /go/src/github.com/prometheus-operator/prometheus-operator
 
@@ -33,7 +33,13 @@ RUN go install github.com/google/go-licenses@latest \
     && go-licenses report github.com/prometheus-operator/prometheus-operator/cmd/operator/ > all-licenses
 
 # Result Image
-FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
+FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
+
+# Patch critical CVEs in base OS layer
+RUN apt-get update && apt-get install -y --only-upgrade \
+    perl \
+    zlib1g \
+    && rm -rf /var/lib/apt/lists/*
 
 ENV C2D_RELEASE=0.77.2
 

docker/prometheus-operator/0/debian12/0.78/Dockerfile

@@ -2,13 +2,13 @@
 ARG BASE_REGISTRY="docker.io"
 FROM docker.io/alpine/git as git
 
-ENV PROMETHEUS_OPERATOR_VERSION=v0.78.0
+ENV PROMETHEUS_OPERATOR_VERSION=v0.78.2
 
 RUN git clone https://github.com/prometheus-operator/prometheus-operator.git /src/prometheus-operator/ \
     && cd /src/prometheus-operator/ \
     && git checkout $PROMETHEUS_OPERATOR_VERSION
 
-FROM docker.io/golang as builder
+FROM docker.io/library/golang:1.25-bookworm as builder
 
 COPY --from=git /src/prometheus-operator /go/src/github.com/prometheus-operator/prometheus-operator
 
@@ -21,8 +21,8 @@ RUN set -x && \
 
 RUN git config --global http.sslverify false \
     && GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -a -installsuffix cgo -ldflags="-s \
-    -X github.com/prometheus/common/version.Version=0.78.0 \
-    -X github.com/prometheus/common/version.Branch=0.78.0 \
+    -X github.com/prometheus/common/version.Version=0.78.2 \
+    -X github.com/prometheus/common/version.Branch=0.78.2 \
     -X github.com/prometheus/common/version.BuildUser=C2D \
     -X github.com/prometheus/common/version.BuildDate=$(date '+%Y-%m-%d')" \
     -o operator cmd/operator/main.go
@@ -33,9 +33,15 @@ RUN go install github.com/google/go-licenses@latest \
     && go-licenses report github.com/prometheus-operator/prometheus-operator/cmd/operator/ > all-licenses
 
 # Result Image
-FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
+FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
 
-ENV C2D_RELEASE=0.78.0
+# Patch critical CVEs in base OS layer
+RUN apt-get update && apt-get install -y --only-upgrade \
+    perl \
+    zlib1g \
+    && rm -rf /var/lib/apt/lists/*
+
+ENV C2D_RELEASE=0.78.2
 
 # Binaries
 COPY --from=builder /go/src/github.com/prometheus-operator/prometheus-operator/operator /bin

docker/prometheus-operator/templates/Dockerfile.template

@@ -11,7 +11,7 @@ RUN git clone https://github.com/prometheus-operator/prometheus-operator.git /sr
     && cd /src/prometheus-operator/ \
     && git checkout $PROMETHEUS_OPERATOR_VERSION
 
-FROM docker.io/golang as builder
+FROM docker.io/library/golang:{{ $golang.Version }}-bookworm as builder
 
 COPY --from=git /src/prometheus-operator /go/src/github.com/prometheus-operator/prometheus-operator
 
@@ -38,6 +38,12 @@ RUN go install github.com/google/go-licenses@latest \
 # Result Image
 FROM {{ .From }}
 
+# Patch critical CVEs in base OS layer
+RUN apt-get update && apt-get install -y --only-upgrade \
+    perl \
+    zlib1g \
+    && rm -rf /var/lib/apt/lists/*
+
 ENV C2D_RELEASE={{ $prometheus_operator.Version }}
 
 # Binaries

docker/prometheus-operator/versions.yaml

@@ -23,18 +23,18 @@ cloudbuild:
   enable_parallel: false
 versions:
 - dir: 0/debian12/0.78
-  from: marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
+  from: marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
   packages:
     prometheus-operator:
-      version: 0.78.0
+      version: 0.78.2
     golang:
-      version: '1.23.1'
+      version: '1.25'
   repo: prometheus-operator0
   tags:
-  - 0.78.0-debian12
+  - 0.78.2-debian12
   - 0.78-debian12
   - 0-debian12
-  - 0.78.0
+  - 0.78.2
   - '0.78'
   - '0'
   - latest
@@ -47,12 +47,12 @@ versions:
   - deb.debian.org
 
 - dir: 0/debian12/0.77
-  from: marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
+  from: marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
   packages:
     prometheus-operator:
       version: 0.77.2
     golang:
-      version: '1.23.1'
+      version: '1.25'
   repo: prometheus-operator0
   tags:
   - 0.77.2-debian12