diff --git a/.github/workflows/.trivyignore b/.github/workflows/.trivyignore index e69de29..7347194 100644 --- a/.github/workflows/.trivyignore +++ b/.github/workflows/.trivyignore @@ -0,0 +1,4 @@ +# Date: Feb 12, 2024 +# Notes: Issue with libexpat, parsing large tokens can trigger a denial of service +# Needs to be fixed in Docker Image. +CVE-2023-6378 \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index ff9a876..456931e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,10 +1,10 @@ -FROM eclipse-temurin:21-jdk-alpine AS builder +FROM eclipse-temurin:21-jre-alpine AS builder WORKDIR application ARG JAR_FILE=target/*.jar COPY ${JAR_FILE} application.jar RUN java -Djarmode=layertools -jar application.jar extract -FROM eclipse-temurin:21-jdk-alpine +FROM eclipse-temurin:21-jre-alpine RUN adduser -D -u 1000 java WORKDIR application COPY --chown=java:java --from=builder application/dependencies/ ./