Repository navigation
Conversation
Bump dockerize from v0.10.1 to v0.16.0 to clear 16 HIGH vulnerabilities in its bundled golang.org/x/crypto (v0.47.0) and golang.org/x/net (v0.49.0). v0.16.0 requires Go 1.27.3, so the dockerize-builder stage moves to golang:1.27.3-alpine3.23. dockerize v0.16.0 writes rendered templates atomically, through a temp file in the destination directory. ./config was owned by root while the container runs as temporal (uid 1000), so the legacy config-template.yaml path in start-ui-server.sh failed with "permission denied". Make ./config owned by temporal.
|
@bojanraic is attempting to deploy a commit to the Temporal Team on Vercel. A member of the Team first needs to authorize it. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description & motivation 💭
Bumps dockerize in
server/Dockerfilefrom v0.10.1 to v0.16.0. The v0.10.1 binary bundlesgolang.org/x/cryptov0.47.0 andgolang.org/x/netv0.49.0, which trivy reports as 16 HIGH vulnerabilities intemporalio/ui:2.57.0.dockerize-buildermoves togolang:1.27.3-alpine3.23, because dockerize v0.16.0 requires Go 1.27.3../configis now owned bytemporal. dockerize v0.16.0 writes rendered templates atomically, through a temp file in the destination directory. With./configowned by root and the container running as uid 1000, the legacyconfig-template.yamlpath instart-ui-server.shfails with:This supersedes #4040, which bumped to v0.15.2 and was closed unmerged.
Testing 🧪
How was this tested 👻
I built the
dockerize-builderstage for linux/amd64 and copied its binary intotemporalio/ui:2.57.0. I applied the./configownership change to that image too. I did not build the full image from a bare checkout, becauseserver-builderembedsserver/ui/assetsfrom the frontend build.usr/local/bin/dockerizedockerize -templatewith.Env,env | defaultandsplitconfig-template.yaml→./config/docker.yamlchown)GET /trivy still exits 1 on both images. The remaining 5 findings are in the
ui-serverbinary itself (labstack/echo/v4v4.15.4,gomarkdown/markdown) and are outside this PR.Steps for others to test: 🚶🏽♂️🚶🏽♀️
trivy image --scanners vuln --ignore-unfixed --severity CRITICAL,HIGH <image>and confirm there are no findings underusr/local/bin/dockerize.docker run --rm --entrypoint dockerize <image> --help./home/ui-server/config-template.yaml, createconfig/config-template.yamlto trigger the legacy branch, and confirmstart-ui-server.shrenders./config/docker.yaml.Docs
Any docs updates needed?
dockerize v0.16.0 can no longer render to
/dev/stdout, because it creates its temp file next to the destination. Nothing in this repo does that, but custom entrypoints that do will need a writable destination directory.