From db7d9e9cc838b35c514e3ec1f553571dbaf78fa5 Mon Sep 17 00:00:00 2001 From: mayankpande88 Date: Thu, 9 Jul 2026 18:18:38 +0530 Subject: [PATCH 1/2] security(bpf): bump agent builder to go 1.26.4 + apk upgrade alpine base The application-profiler-bpf image carried 27 fixable CVEs: - 3 Go stdlib in the bundled agent binary (built with golang:1.26.3-alpine) -> bump the agentbuild stage to golang:1.26.4-alpine. - 24 Alpine OS packages (libssl3/libcrypto3 3.5.6-r0 -> 3.5.7-r0, libexpat, libxml2) that the pinned alpine:3.23.4 snapshot ships stale -> add `apk upgrade --no-cache` in the final stage before installing the tools. Verified: agentbuild stage compiles; the extracted agent binary reports go1.26.4 and 0 fixable CRITICAL/HIGH/MEDIUM; `apk upgrade` on alpine:3.23.4 moves libssl3/libcrypto3 to the patched 3.5.7-r0. Part of the nudgebee image-hardening effort (nudgebee/nudgebee#578). --- docker/bpf/Dockerfile | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docker/bpf/Dockerfile b/docker/bpf/Dockerfile index b5d2db5..0fb2a7e 100644 --- a/docker/bpf/Dockerfile +++ b/docker/bpf/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.3-alpine AS agentbuild +FROM golang:1.26.4-alpine AS agentbuild WORKDIR /go/src/github.com/nudgebee/application-profiler COPY . /go/src/github.com/nudgebee/application-profiler RUN go get -d -v ./... @@ -10,7 +10,11 @@ RUN apk add --no-cache git \ && git clone https://github.com/brendangregg/FlameGraph FROM alpine:3.23.4 -RUN apk add --no-cache bash bcc-tools perl procps strace util-linux iproute2 \ +# apk upgrade pulls the latest 3.23 patch level for the base + dependency +# packages (libssl3/libcrypto3 3.5.6-r0 -> 3.5.7-r0, libexpat, libxml2), which +# the pinned alpine:3.23.4 snapshot otherwise ships stale. +RUN apk upgrade --no-cache \ + && apk add --no-cache bash bcc-tools perl procps strace util-linux iproute2 \ && mkdir -p /app/FlameGraph COPY --from=builder /FlameGraph /app/FlameGraph COPY --from=agentbuild /go/bin/agent /app From 2f179229ecd930b30f8b30dd962b30ad8536fcd0 Mon Sep 17 00:00:00 2001 From: mayankpande88 Date: Thu, 9 Jul 2026 18:23:23 +0530 Subject: [PATCH 2/2] security(bpf): single apk index fetch (review feedback) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Consolidate to apk update && upgrade && add && rm cache — one index fetch instead of two --no-cache passes — and fix the double space in the package list. Built the full bpf image: 0 fixable C/H/M, agent binary runs. --- docker/bpf/Dockerfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docker/bpf/Dockerfile b/docker/bpf/Dockerfile index 0fb2a7e..be942af 100644 --- a/docker/bpf/Dockerfile +++ b/docker/bpf/Dockerfile @@ -13,8 +13,10 @@ FROM alpine:3.23.4 # apk upgrade pulls the latest 3.23 patch level for the base + dependency # packages (libssl3/libcrypto3 3.5.6-r0 -> 3.5.7-r0, libexpat, libxml2), which # the pinned alpine:3.23.4 snapshot otherwise ships stale. -RUN apk upgrade --no-cache \ - && apk add --no-cache bash bcc-tools perl procps strace util-linux iproute2 \ +RUN apk update \ + && apk upgrade \ + && apk add bash bcc-tools perl procps strace util-linux iproute2 \ + && rm -rf /var/cache/apk/* \ && mkdir -p /app/FlameGraph COPY --from=builder /FlameGraph /app/FlameGraph COPY --from=agentbuild /go/bin/agent /app