Hello everyone, I'm curious if anyone (probably from a large organization) has had to do security patching for the OSS docker images and if so, what they're doing to automate this process? We are trying to minimize operational maintenance, and part of that is having to manually construct a hardened image based off of the original OSS image. That includes changing the base images to security hardened ones, using the latest source code, using a different nginx conf file, using a different npm registry, etc. The are lots of little fragmented changes that I do to manually adapt the original docker files, and it would make automation not so straight-forward. Curious about what patterns and technologies others are using to automate patching for these images.

@acoustic-van-30942 - on the OSS side, we are investing in efforts to keep the images up to date and address known critical vulnerabilities pro-actively. However, there may still be certain areas which may require you to maintain your own set of images for the service and UI. Thankfully, those images are simple, with very few dependencies, so the overall burden of maintaining them by yourself, while not zero, isn't very high. However, that said, if there are specific work items and modifications to the docker file, that will help ensure that the images stay compliant - we are happy to address that - just let us know!

Thanks @square-wire-39606,

However, there may still be certain areas which may require you to maintain your own set of images for the service and UI

Yup this is correct. Would it be possible to set aside 15-20 minutes with you to discuss the deltas and what changes we had to make?

Sure