Skip to content

Container Solution - CVE Fix - Argo workflows #3053

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DivyaUpreti merged 12 commits into from
Aug 3, 2026
Merged

Container Solution - CVE Fix - Argo workflows #3053

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
e3f681e
fix: refresh triggers
Feb 18, 2026
77e1c7d
Merge branch 'master' of github.com:GoogleCloudPlatform/click-to-deploy
Feb 19, 2026
c434253
Merge branch 'master' of github.com:GoogleCloudPlatform/click-to-deploy
Apr 9, 2026
20d6c49
merge branch 'master' of github.com:GoogleCloudPlatform/click-to-deploy
May 28, 2026
2841068
Merge branch 'master' of github.com:GoogleCloudPlatform/click-to-deploy
May 29, 2026
e31c32c
Merge branch 'master' of github.com:GoogleCloudPlatform/click-to-deploy
Jun 3, 2026
8d7d22d
Merge branch 'master' of github.com:GoogleCloudPlatform/click-to-deploy
Jun 4, 2026
82f8939
Merge branch 'master' of github.com:GoogleCloudPlatform/click-to-deploy
Jun 7, 2026
88d0a7c
Merge branch 'master' of github.com:GoogleCloudPlatform/click-to-deploy
Jul 31, 2026
72a09b0
Merge branch 'master' of github.com:GoogleCloudPlatform/click-to-deploy
Aug 2, 2026
b240868
Patch critical CVEs for Argo Workflows 4.0, 3.6, and 3.5 containers
Aug 2, 2026
b73aae1
Merge branch 'master' into argo-workflows-cvefix
DivyaUpreti Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions docker/argo-workflows/3/debian12/3.5/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@

ARG BASE_REGISTRY="docker.io"

FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861 as ospo
FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0 as ospo

# Download Licenses and restricted source-code
COPY components.csv /components.csv
Expand All @@ -36,7 +36,7 @@ RUN mkdir -p /usr/src/licenses \
&& /download-ref-repos.sh /source_code.txt /usr/src

# Stage: Server and Workflow Controller: Builder
FROM docker.io/golang as builder
FROM docker.io/library/golang:1.25-bookworm as builder

ARG ARGO_VERSION="3.5.14"
ENV ARGO_VERSION "${ARGO_VERSION}"
Expand Down Expand Up @@ -65,10 +65,10 @@ RUN go mod download


# Stage: Server: UI
FROM docker.io/node as argo-ui
FROM docker.io/library/node:20-bookworm as argo-ui

# Install yarn globally
RUN npm install -g yarn
RUN npm install -g yarn --force

COPY --from=builder /go/src/github.com/argoproj/argo-workflows/ui/package.json ui/
COPY --from=builder /go/src/github.com/argoproj/argo-workflows/ui/yarn.lock ui/
Expand Down Expand Up @@ -110,7 +110,13 @@ RUN target=/root/.cache/go-build make dist/argo


# Stage: Final Image
FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0

# Patch critical CVEs in base OS layer
RUN apt-get update && apt-get install -y --only-upgrade \
perl \
zlib1g \
&& rm -rf /var/lib/apt/lists/*

COPY --from=ospo /usr/src /usr/src

Expand Down
16 changes: 11 additions & 5 deletions docker/argo-workflows/3/debian12/3.6/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@

ARG BASE_REGISTRY="docker.io"

FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861 as ospo
FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0 as ospo

# Download Licenses and restricted source-code
COPY components.csv /components.csv
Expand All @@ -36,7 +36,7 @@ RUN mkdir -p /usr/src/licenses \
&& /download-ref-repos.sh /source_code.txt /usr/src

# Stage: Server and Workflow Controller: Builder
FROM docker.io/golang as builder
FROM docker.io/library/golang:1.25-bookworm as builder

ARG ARGO_VERSION="3.6.7"
ENV ARGO_VERSION "${ARGO_VERSION}"
Expand Down Expand Up @@ -65,10 +65,10 @@ RUN go mod download


# Stage: Server: UI
FROM docker.io/node as argo-ui
FROM docker.io/library/node:20-bookworm as argo-ui

# Install yarn globally
RUN npm install -g yarn
RUN npm install -g yarn --force

COPY --from=builder /go/src/github.com/argoproj/argo-workflows/ui/package.json ui/
COPY --from=builder /go/src/github.com/argoproj/argo-workflows/ui/yarn.lock ui/
Expand Down Expand Up @@ -110,7 +110,13 @@ RUN target=/root/.cache/go-build make dist/argo


# Stage: Final Image
FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0

# Patch critical CVEs in base OS layer
RUN apt-get update && apt-get install -y --only-upgrade \
perl \
zlib1g \
&& rm -rf /var/lib/apt/lists/*

COPY --from=ospo /usr/src /usr/src

Expand Down
20 changes: 13 additions & 7 deletions docker/argo-workflows/4/debian12/4.0/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@

ARG BASE_REGISTRY="docker.io"

FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861 as ospo
FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0 as ospo

# Download Licenses and restricted source-code
COPY components.csv /components.csv
Expand All @@ -36,9 +36,9 @@ RUN mkdir -p /usr/src/licenses \
&& /download-ref-repos.sh /source_code.txt /usr/src

# Stage: Server and Workflow Controller: Builder
FROM docker.io/golang as builder
FROM docker.io/library/golang:1.25-bookworm as builder

ARG ARGO_VERSION="4.0.6"
ARG ARGO_VERSION="4.0.8"
ENV ARGO_VERSION "${ARGO_VERSION}"

RUN apt-get update && apt-get --no-install-recommends install -y \
Expand All @@ -65,10 +65,10 @@ RUN go mod download


# Stage: Server: UI
FROM docker.io/node as argo-ui
FROM docker.io/library/node:20-bookworm as argo-ui

# Install yarn globally
RUN npm install -g yarn
RUN npm install -g yarn --force

COPY --from=builder /go/src/github.com/argoproj/argo-workflows/ui/package.json ui/
COPY --from=builder /go/src/github.com/argoproj/argo-workflows/ui/yarn.lock ui/
Expand Down Expand Up @@ -110,11 +110,17 @@ RUN target=/root/.cache/go-build make dist/argo


# Stage: Final Image
FROM marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
FROM marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0

# Patch critical CVEs in base OS layer
RUN apt-get update && apt-get install -y --only-upgrade \
perl \
zlib1g \
&& rm -rf /var/lib/apt/lists/*

COPY --from=ospo /usr/src /usr/src

ENV C2D_RELEASE "4.0.6"
ENV C2D_RELEASE "4.0.8"
USER 8737

# Controller artifacts
Expand Down
12 changes: 9 additions & 3 deletions docker/argo-workflows/templates/Dockerfile.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ RUN mkdir -p /usr/src/licenses \
&& /download-ref-repos.sh /source_code.txt /usr/src

# Stage: Server and Workflow Controller: Builder
FROM docker.io/golang as builder
FROM docker.io/library/golang:{{ $golang.Version }}-bookworm as builder

ARG ARGO_VERSION="{{ $argo_workflows.Version }}"
ENV ARGO_VERSION "${ARGO_VERSION}"
Expand Down Expand Up @@ -65,10 +65,10 @@ RUN go mod download


# Stage: Server: UI
FROM docker.io/node as argo-ui
FROM docker.io/library/node:{{ $nodejs.Major }}-bookworm as argo-ui

# Install yarn globally
RUN npm install -g yarn
RUN npm install -g yarn --force

COPY --from=builder /go/src/github.com/argoproj/argo-workflows/ui/package.json ui/
COPY --from=builder /go/src/github.com/argoproj/argo-workflows/ui/yarn.lock ui/
Expand Down Expand Up @@ -112,6 +112,12 @@ RUN target=/root/.cache/go-build make dist/argo
# Stage: Final Image
FROM {{ .From }}

# Patch critical CVEs in base OS layer
RUN apt-get update && apt-get install -y --only-upgrade \
perl \
zlib1g \
&& rm -rf /var/lib/apt/lists/*

COPY --from=ospo /usr/src /usr/src

ENV C2D_RELEASE "{{ $argo_workflows.Version }}"
Expand Down
18 changes: 9 additions & 9 deletions docker/argo-workflows/versions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,20 +21,20 @@ versions:
- key: com.googleapis.cloudmarketplace.product.service.name
value: services/dea629ec-49b1-439e-928d-1b08fa253321.cloudpartnerservices.goog
dir: 4/debian12/4.0
from: marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
from: marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
packages:
argo_workflows:
version: 4.0.6
version: 4.0.8
golang:
version: '1.24'
version: '1.25'
nodejs:
major: '20'
repo: argo-workflows4
tags:
- 4.0.6-debian12
- 4.0.8-debian12
- 4.0-debian12
- 4-debian12
- 4.0.6
- 4.0.8
- '4.0'
- '4'
- latest
Expand All @@ -52,12 +52,12 @@ versions:
- key: com.googleapis.cloudmarketplace.product.service.name
value: services/dea629ec-49b1-439e-928d-1b08fa253321.cloudpartnerservices.goog
dir: 3/debian12/3.6
from: marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
from: marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
packages:
argo_workflows:
version: 3.6.7
golang:
version: '1.24'
version: '1.25'
nodejs:
major: '20'
repo: argo-workflows3
Expand All @@ -82,12 +82,12 @@ versions:
- key: com.googleapis.cloudmarketplace.product.service.name
value: services/dea629ec-49b1-439e-928d-1b08fa253321.cloudpartnerservices.goog
dir: 3/debian12/3.5
from: marketplace.gcr.io/google/debian12@sha256:f13f9826c524466f844e74534b8add32f51acd2be428b5dee782fe9086e59861
from: marketplace.gcr.io/google/debian12@sha256:c2a5eb3516da4c3bb0cf2d6fea739bd7b2dc7b1ac444b5fbd7c4def2aa57d4a0
packages:
argo_workflows:
version: 3.5.14
golang:
version: '1.23'
version: '1.25'
nodejs:
major: '20'
repo: argo-workflows3
Expand Down
Loading