Skip to content

RHAIENG-987: remove skopeo and OpenShift client installation from RStudio Dockerfiles to address CVE-2025-4674 #2384

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 12, 2025
Merged

RHAIENG-987: remove skopeo and OpenShift client installation from RStudio Dockerfiles to address CVE-2025-4674 #2384

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5c1b328
RHAIENG-987: remove `skopeo` and OpenShift client installation from R…
jiridanek Sep 10, 2025
8b7d74a
fix(tests): remove stray `oc version` call in tests
jiridanek Sep 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 2 additions & 8 deletions rstudio/c9s-python-3.11/Dockerfile.cpu
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,18 +23,12 @@ RUN dnf -y upgrade --refresh --best --nodocs --noplugins --setopt=install_weak_d
# upgrade first to avoid fixable vulnerabilities end

# Install useful OS packages
RUN dnf install -y mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum
# remove skopeo, CVE-2025-4674
RUN dnf install -y mesa-libGL && dnf clean all && rm -rf /var/cache/yum

# Other apps and tools installed as default user
USER 1001

# Install the oc client begin
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does the oc bring also cves?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, so does skopeo. Issues already filed in both of those projects. Happy to provide links if needed.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz && \
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
rm -f /tmp/openshift-client-linux.tar.gz
# Install the oc client end

WORKDIR /opt/app-root/src

#####################
Expand Down
10 changes: 2 additions & 8 deletions rstudio/c9s-python-3.11/Dockerfile.cuda
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,18 +25,12 @@ RUN dnf -y upgrade --refresh --best --nodocs --noplugins --setopt=install_weak_d
# upgrade first to avoid fixable vulnerabilities end

# Install useful OS packages
RUN dnf install -y mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum
# remove skopeo, CVE-2025-4674
RUN dnf install -y mesa-libGL && dnf clean all && rm -rf /var/cache/yum

# Other apps and tools installed as default user
USER 1001

# Install the oc client begin
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz && \
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
rm -f /tmp/openshift-client-linux.tar.gz
# Install the oc client end

WORKDIR /opt/app-root/src

#####################
Expand Down
10 changes: 2 additions & 8 deletions rstudio/rhel9-python-3.11/Dockerfile.cpu
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,18 +18,12 @@ RUN dnf -y upgrade --refresh --best --nodocs --noplugins --setopt=install_weak_d
# upgrade first to avoid fixable vulnerabilities end

# Install useful OS packages
RUN dnf install -y mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum
# remove skopeo, CVE-2025-4674
RUN dnf install -y mesa-libGL && dnf clean all && rm -rf /var/cache/yum

# Other apps and tools installed as default user
USER 1001

# Install the oc client begin
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz && \
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
rm -f /tmp/openshift-client-linux.tar.gz
# Install the oc client end

WORKDIR /opt/app-root/src

#####################
Expand Down
10 changes: 2 additions & 8 deletions rstudio/rhel9-python-3.11/Dockerfile.cuda
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,18 +20,12 @@ RUN dnf -y upgrade --refresh --best --nodocs --noplugins --setopt=install_weak_d
# upgrade first to avoid fixable vulnerabilities end

# Install useful OS packages
RUN dnf install -y mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum
# remove skopeo, CVE-2025-4674
RUN dnf install -y mesa-libGL && dnf clean all && rm -rf /var/cache/yum

# Other apps and tools installed as default user
USER 1001

# Install the oc client begin
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz && \
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
rm -f /tmp/openshift-client-linux.tar.gz
# Install the oc client end

WORKDIR /opt/app-root/src

################
Expand Down
25 changes: 15 additions & 10 deletions scripts/dockerfile_fragments.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,16 +36,17 @@ def main():
prefix="Install micropipenv and uv to deploy packages from requirements.txt",
)

blockinfile(
dockerfile,
textwrap.dedent(r"""
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz && \
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
rm -f /tmp/openshift-client-linux.tar.gz
"""),
prefix="Install the oc client",
)
if not is_rstudio(dockerfile):
blockinfile(
dockerfile,
textwrap.dedent(r"""
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
-o /tmp/openshift-client-linux.tar.gz && \
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
rm -f /tmp/openshift-client-linux.tar.gz
"""),
prefix="Install the oc client",
)

if is_jupyter(dockerfile):
blockinfile(
Expand Down Expand Up @@ -106,6 +107,10 @@ def is_jupyter(filename: pathlib.Path) -> bool:
return filename.is_relative_to(ROOT_DIR / "jupyter")


def is_rstudio(filename: pathlib.Path) -> bool:
return filename.is_relative_to(ROOT_DIR / "rstudio")


if __name__ == "__main__":
main()

Expand Down
13 changes: 8 additions & 5 deletions tests/containers/base_image_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,11 +92,6 @@ def check_elf_file():
json.dumps({"dir": path, "count_scanned": count_scanned, "unsatisfied": unsatisfied_deps}),
)

ecode, output = container.exec(["/bin/sh", "-c", "oc version"])

logging.debug(output.decode())
assert ecode == 0

_ecode, output = container.exec(
encode_python_function_execution_command_interpreter("/usr/bin/python3", check_elf_file)
)
Expand Down Expand Up @@ -128,6 +123,9 @@ def check_elf_file():
self._run_test(image=image, test_fn=test_fn)

def test_oc_command_runs(self, image: str):
if utils.is_rstudio_image(image):
pytest.skip("oc command is not preinstalled in RStudio images.")

def test_fn(container: testcontainers.core.container.DockerContainer):
ecode, output = container.exec(["/bin/sh", "-c", "oc version"])

Expand All @@ -137,6 +135,9 @@ def test_fn(container: testcontainers.core.container.DockerContainer):
self._run_test(image=image, test_fn=test_fn)

def test_skopeo_command_runs(self, image: str):
if utils.is_rstudio_image(image):
pytest.skip("skopeo command is not preinstalled in RStudio images.")

def test_fn(container: testcontainers.core.container.DockerContainer):
ecode, output = container.exec(["/bin/sh", "-c", "skopeo --version"])

Expand Down Expand Up @@ -164,6 +165,8 @@ def test_oc_command_runs_fake_fips(self, image: str, subtests: pytest_subtests.S
"""Establishes a best-effort fake FIPS environment and attempts to execute `oc` binary in it.

Related issue: RHOAIENG-4350 In workbench the oc CLI tool cannot be used on FIPS enabled cluster"""
if utils.is_rstudio_image(image):
pytest.skip("oc command is not preinstalled in RStudio images.")
with tempfile.TemporaryDirectory() as tmp_crypto:
# Ubuntu does not even have /proc/sys/crypto directory, unless FIPS is activated and machine
# is rebooted, see https://ubuntu.com/security/certifications/docs/fips-enablement
Expand Down
Loading