Daily Docker image releases

[C85297]

Hello,

We have noticed that the Concourse 7.12.1 Docker image has been re-pushed every weekday at around 19:15 GMT since the 24 January. Each time the image has a different hash, and this has caused concern from a security perspective.
We were wondering whether this is intentional, and what the purpose of re-pushing the image is.
Any information on this would be really appreciated!

[taylorsilva]

Great question!

Quite a few years back now we had added image scanning to our pipelines. A lot of these tools picked up CVE's related to OS packages in the image, so stuff not directly related to Concourse (most of the time).

Most of these were "fixed" by just re-building the image and pulling the latest packages (apt-get update, etc.). That happens in this job here for 7.12.x: https://ci.concourse-ci.org/teams/main/pipelines/release/jobs/rebuild-images/builds/33?vars.version=%227.12.x%22

That was the thought back then. Not sure if knowing about that makes it "safe" now. I always felt the practice was a bit overkill. I don't think anyone was really asking for this, but it was easy to do and we just did it at the time. Does this practice make any sense?

All the resource-types do this too. Each one has a republish-images job: https://ci.concourse-ci.org/teams/main/pipelines/resource?vars.type=%22mock%22&group=republish

We should probably re-evaluate how the images are built at some point and trim them down. I think Rui did a bit of that for the resource-types, not sure if that work made it's way into concourse/concourse image itself.

[C85297]

Hi @taylorsilva - thanks for the quick response, that’s really helpful to understand. Trimming down the images sounds like a good idea, so there’s less components that could have vulnerabilities - but if there are components with vulnerabilities it does probably make sense to rebuild the image.
Its great that releases are done through a pipeline where anyone can see the build history and understand exactly how the image was built - this I think satisfies any concerns we had over what had changed between image pushes.