From 44fe3546d1a7ee16ad97da9b0c3606ec551f554c Mon Sep 17 00:00:00 2001 From: Lucas Vieira Date: Tue, 15 Sep 2026 11:48:03 -0300 Subject: [PATCH] fix(docker): bump bundled docker CLI to 29.8.0 to clear Go stdlib HIGHs The Docker workflow's Trivy gate went red on main: the bundled static docker CLI (/usr/local/bin/docker) at 29.7.2 is compiled with go1.26.5, which the vulnerability DB now flags with six HIGH Go stdlib advisories (CVE-2026-33818, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862), all fixed in go1.26.6+. Docker 29.8.0 is built with go1.26.8. Verified with Trivy 0.70.0 (the version the workflow pins) against both static builds: linux/amd64 and linux/arm64 each report 0 HIGH/CRITICAL. The two previously suppressed CVEs (CVE-2026-39821, CVE-2026-46600) are stdlib-vendored x/net issues also fixed by the newer toolchain, so .trivyignore no longer needs any entry. - Dockerfile: DOCKER_CLI_VERSION 29.7.2 -> 29.8.0, comment updated - .trivyignore: drop both entries; keep the file (trivy-action fails hard when `trivyignores:` points at a missing path) with a note on when adding an entry is the right move versus bumping the pin Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015paJopoDarw6WeFFoZMDMf --- .trivyignore | 32 ++++++++++++++------------------ Dockerfile | 9 +++++---- 2 files changed, 19 insertions(+), 22 deletions(-) diff --git a/.trivyignore b/.trivyignore index 0f523fa16..50b0bdb12 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,21 +1,17 @@ -# Go stdlib HIGH vulnerabilities present ONLY in the bundled static Docker CLI -# (/usr/local/bin/docker, from the docker-cli build stage), which as of -# DOCKER_CLI_VERSION 29.7.2 is compiled with go1.26.5. Both are fixed upstream -# only in go1.26.6 / 1.27.0-rc.3, and no Docker static release ships a -# go>=1.26.6 toolchain yet (latest 29.7.2 is still on go1.26.5), so the CLI -# version cannot be bumped past it. +# Intentionally empty of CVE entries. # -# Not exploitable in fakecloud's usage: fakecloud shells out to the docker CLI -# purely for container lifecycle (run/exec/cp/rm). It never processes untrusted -# Punycode/IDNA hostnames (CVE-2026-39821) or parses untrusted DNS wire messages -# (CVE-2026-46600) through the CLI. Our own binary is Rust. +# This file must exist: the Docker workflow's Trivy step passes +# `trivyignores: .trivyignore`, and trivy-action fails hard with +# "cannot find ignorefile '.trivyignore'" when it is missing. # -# REMOVE these entries once a Docker static release built with go>=1.26.6 exists -# and DOCKER_CLI_VERSION in the Dockerfile is bumped to it. +# The only recurring source of HIGH findings in the image is the bundled +# static Docker CLI (/usr/local/bin/docker), whose binary bakes in the Go +# stdlib — a stale Docker release therefore carries stale-toolchain CVEs. +# DOCKER_CLI_VERSION 29.8.0 ships go1.26.8 and scans clean on both +# linux/amd64 and linux/arm64, so nothing needs suppressing today. # -# CVE-2026-39821 — golang.org/x/net/idna: privilege escalation via incorrect -# Punycode label processing. -# CVE-2026-46600 — golang.org/x/net/dns/dnsmessage: denial of service via -# invalid DNS record parsing. -CVE-2026-39821 -CVE-2026-46600 +# When a new Go stdlib advisory lands, prefer bumping DOCKER_CLI_VERSION in +# the Dockerfile to a static release built with the fixed toolchain. Only add +# an entry here when no such release exists yet, and say why the CVE is not +# reachable through fakecloud's usage (it shells out to the CLI purely for +# container lifecycle: run/exec/cp/rm; fakecloud's own binary is Rust). diff --git a/Dockerfile b/Dockerfile index 1f1a849f5..522c202e1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,10 +23,11 @@ ARG TARGETARCH # Pin a docker CLI built with a current Go toolchain — the static build # bakes the Go stdlib into the binary, so a stale toolchain trips the # image's Trivy CRITICAL/HIGH gate (27.5.1 shipped go1.22.11, flagged by -# CVE-2025-68121). 29.7.2 ships go1.26.5, which clears CVE-2026-39822; the -# two remaining stdlib HIGHs (CVE-2026-39821, CVE-2026-46600) are fixed only -# in go1.26.6, which no Docker static release ships yet — see .trivyignore. -ARG DOCKER_CLI_VERSION=29.7.2 +# CVE-2025-68121; 29.7.2 shipped go1.26.5, flagged by CVE-2026-33818 and the +# CVE-2026-568xx batch). 29.8.0 ships go1.26.8, which clears every known +# stdlib HIGH — both linux/amd64 and linux/arm64 static builds scan clean, so +# .trivyignore carries no entries. +ARG DOCKER_CLI_VERSION=29.8.0 RUN apt-get update \ && apt-get install -y --no-install-recommends curl ca-certificates \ && case "$TARGETARCH" in \