From 33fc5f0306426ce65c54fae444f55061f9ad5f60 Mon Sep 17 00:00:00 2001 From: Christian Haudum Date: Mon, 25 Nov 2024 12:03:07 +0100 Subject: [PATCH] Remove `wget` from Promtail docker image The package has been added to the Docker image with PR #11711 with the intention to support the Docker healthcheck. However, to reduce the attack surface of our Docker images, we want to keep them as slim as possible. The current version of Promtail (3.3.0) for example contains a wget version with vulnerability [CVE-2024-38428](https://security-tracker.debian.org/tracker/CVE-2024-38428). The healthcheck can be achieved by other means, e.g. 1. Extend the `grafana/promtail` base image and add `wget` using `apt install wget` https://github.com/grafana/loki/issues/11590#issuecomment-2106037181 2. Use low-level `/dev/tcp/127.0.0.1:9080` to establish a connection and check the exit code https://github.com/grafana/loki/issues/11590#issuecomment-2333481326 Signed-off-by: Christian Haudum --- clients/cmd/promtail/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clients/cmd/promtail/Dockerfile b/clients/cmd/promtail/Dockerfile index 1975485e372ae..1f1825f1a5563 100644 --- a/clients/cmd/promtail/Dockerfile +++ b/clients/cmd/promtail/Dockerfile @@ -10,7 +10,7 @@ RUN make clean && make BUILD_IN_CONTAINER=false PROMTAIL_JOURNAL_ENABLED=true pr FROM debian:12.8-slim # tzdata required for the timestamp stage to work RUN apt-get update && \ - apt-get install -qy tzdata ca-certificates wget libsystemd-dev && \ + apt-get install -qy tzdata ca-certificates libsystemd-dev && \ rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml