mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-31 07:44:57 +08:00
John T. Myers
c6f579279e
Bumps the CI image tool pins to clear High-severity container findings
flagged by nSpect against ghcr.io/nvidia/openshell/ci. These tools
vendor the Go modules reported in the nSpect tracker.
Changes:
- DOCKER_VERSION 29.3.1 -> 29.4.1
- BUILDX_VERSION v0.32.1 -> v0.33.0 (bundles buildkit v0.29.0,
supersedes 0.28.1 fix)
- GH_VERSION 2.74.1 -> 2.91.0
- MISE_VERSION v2026.3.13 -> v2026.4.18
Covers (via vendored deps in the above binaries):
- GHSA-p77j-4mvh-x3m3 grpc-go authorization bypass
- GHSA-4c29-8rgm-jvjj BuildKit malicious-frontend file escape
- GHSA-4vrq-3vrq-g6gg BuildKit Git subdir access to restricted files
- GHSA-9h8m-3fm2-qjrq OpenTelemetry Go SDK PATH hijacking
- GHSA-92mm-2pjq-r785 hashicorp/go-getter arbitrary file reads
- GHSA-78h2-9frx-2jm8 go-jose JWE decryption panic
- GHSA-4qg8-fj49-pxjh sigstore timestamp-authority excessive memory
- GHSA-x744-4wpc-v9h2 Moby AuthZ plugin bypass
Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>
85 lines
2.9 KiB
Docker
85 lines
2.9 KiB
Docker
# syntax=docker/dockerfile:1.4
|
|
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# CI runner image with all development tools pre-installed
|
|
# Rebuild triggered automatically when mise.toml or this file changes
|
|
|
|
FROM nvcr.io/nvidia/base/ubuntu:noble-20251013
|
|
|
|
ARG DOCKER_VERSION=29.4.1
|
|
ARG BUILDX_VERSION=v0.33.0
|
|
ARG TARGETARCH
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
ENV MISE_DATA_DIR=/opt/mise
|
|
ENV MISE_CACHE_DIR=/opt/mise/cache
|
|
ENV PATH="/opt/mise/shims:/root/.cargo/bin:/root/.local/bin:$PATH"
|
|
|
|
# Install system dependencies
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
git \
|
|
build-essential \
|
|
clang \
|
|
libclang-dev \
|
|
libz3-dev \
|
|
pkg-config \
|
|
libssl-dev \
|
|
openssh-client \
|
|
python3 \
|
|
python3-venv \
|
|
cmake \
|
|
socat \
|
|
unzip \
|
|
xz-utils \
|
|
jq \
|
|
rsync \
|
|
zstd \
|
|
&& apt-get install -y --only-upgrade gpgv python3 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Docker CLI and buildx plugin used by CI jobs
|
|
RUN case "$TARGETARCH" in \
|
|
amd64) docker_arch=x86_64; buildx_arch=amd64 ;; \
|
|
arm64) docker_arch=aarch64; buildx_arch=arm64 ;; \
|
|
*) echo "Unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
|
|
esac \
|
|
&& curl -fsSL "https://download.docker.com/linux/static/stable/${docker_arch}/docker-${DOCKER_VERSION}.tgz" \
|
|
| tar xz --strip-components=1 -C /usr/local/bin docker/docker \
|
|
&& mkdir -p /usr/local/lib/docker/cli-plugins \
|
|
&& curl -fsSL "https://github.com/docker/buildx/releases/download/${BUILDX_VERSION}/buildx-${BUILDX_VERSION}.linux-${buildx_arch}" \
|
|
-o /usr/local/lib/docker/cli-plugins/docker-buildx \
|
|
&& chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx
|
|
|
|
# Install GitHub CLI used by install.sh and CI jobs
|
|
ARG GH_VERSION=2.91.0
|
|
RUN case "$TARGETARCH" in \
|
|
amd64) gh_arch=amd64 ;; \
|
|
arm64) gh_arch=arm64 ;; \
|
|
*) echo "Unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
|
|
esac \
|
|
&& curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${gh_arch}.tar.gz" \
|
|
| tar xz --strip-components=2 -C /usr/local/bin "gh_${GH_VERSION}_linux_${gh_arch}/bin/gh"
|
|
|
|
# Install mise
|
|
ARG MISE_VERSION=v2026.4.18
|
|
RUN curl https://mise.run | MISE_VERSION=$MISE_VERSION sh
|
|
|
|
# Copy mise.toml and task includes, then install all tools via mise
|
|
COPY mise.toml /opt/mise/mise.toml
|
|
COPY tasks/ /opt/mise/tasks/
|
|
WORKDIR /opt/mise
|
|
RUN --mount=type=secret,id=MISE_GITHUB_TOKEN \
|
|
export MISE_GITHUB_TOKEN="$(cat /run/secrets/MISE_GITHUB_TOKEN 2>/dev/null || true)" && \
|
|
mise trust /opt/mise/mise.toml && \
|
|
env -u RUSTC_WRAPPER mise install && \
|
|
mise reshim && \
|
|
(/root/.cargo/bin/rustup component remove rust-docs || true) && \
|
|
rm -rf /root/.rustup/toolchains/*/share/doc /root/.rustup/toolchains/*/share/man
|
|
|
|
# Set working directory for CI jobs
|
|
WORKDIR /builds
|