Skip to content

Commit

Permalink
chore!: Remove wget from Promtail docker image (#15101)
Browse files Browse the repository at this point in the history
The package has been added to the Docker image with PR #11711 with the intention to support the Docker healthcheck.

However, to reduce the attack surface of our Docker images, we want to keep them as slim as possible. The current version of Promtail (3.3.0) for example contains a wget version with vulnerability [CVE-2024-38428](https://security-tracker.debian.org/tracker/CVE-2024-38428).

The healthcheck can be achieved by other means, e.g.

1. Extend the `grafana/promtail` base image and add `wget` using `apt install wget`
   #11590 (comment)
3. Use low-level `/dev/tcp/127.0.0.1:9080` to establish a connection and check the exit code
   #11590 (comment)

Original discussion about adding wget #11590
This may break someone's Docker compose installation, when they require on the `wget` powered health check.

Signed-off-by: Christian Haudum <[email protected]>
(cherry picked from commit 2eea546)
  • Loading branch information
chaudum authored and grafana-delivery-bot[bot] committed Nov 27, 2024
1 parent c4cb1a8 commit 741a209
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion clients/cmd/promtail/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ RUN make clean && make BUILD_IN_CONTAINER=false PROMTAIL_JOURNAL_ENABLED=true pr
FROM debian:12.5-slim
# tzdata required for the timestamp stage to work
RUN apt-get update && \
apt-get install -qy tzdata ca-certificates wget libsystemd-dev && \
apt-get install -qy tzdata ca-certificates libsystemd-dev && \
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail
COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml
Expand Down

0 comments on commit 741a209

Please sign in to comment.