Repository navigation
Use apk upgrade on harness images - #2756
Merged
Merged
Conversation
Signed-off-by: Fabian Gonzalez <[email protected]>
…ted packages with resolved CVEs Signed-off-by: Fabian Gonzalez <[email protected]>
…on't work) Signed-off-by: Fabian Gonzalez <[email protected]>
inFocus7
changed the title
chainguard for reduced CVE impactapk upgrade on harness images
inFocus7
changed the title
apk upgrade on harness imagesapk upgrade on harness images
inFocus7
marked this pull request as ready for review
September 9, 2026 16:58
EItanya
approved these changes
Sep 9, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Sep 9, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Sep 9, 2026
teemow
pushed a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 10, 2026
# Context Resolves CVEs with `apk upgrade` on harness images. | harness | total | C | H | M | L | | -------- | ---- | - | - | - | - | | claude (before) | 21 | 0 | 2 | 6 | 12 | | claude (after) | 1 | 0 | 0 | 0 | 0 | | codex (before) | 21 | 0 | 2 | 6 | 12 | | codex (after) | 1 | 0 | 0 | 0 | 0 | # Additional Notes This was originally a `wolfi` migration PR, **but** those migrations were reverted [here](kagent-dev@88dabc0) because `wolfi` would not work cleanly with substrate (at least on arm64 environments, due to known gVisor issues google/gvisor#13542). --------- Signed-off-by: Fabian Gonzalez <[email protected]> (cherry picked from commit 8e1ff48)
teemow
added a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 10, 2026
The controller and Go ADK images are alpine:3.22 plus `apk add`; the base layer's libcrypto3/libssl3 3.5.7-r0 carry CVE-2026-14456 (HIGH, fixed in 3.5.8-r0). `apk upgrade --no-cache` before the add brings the runtime layer to the current Alpine packages, as kagent-dev#2756 did for the harness images.
teemow
pushed a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 10, 2026
# Context Resolves CVEs with `apk upgrade` on harness images. | harness | total | C | H | M | L | | -------- | ---- | - | - | - | - | | claude (before) | 21 | 0 | 2 | 6 | 12 | | claude (after) | 1 | 0 | 0 | 0 | 0 | | codex (before) | 21 | 0 | 2 | 6 | 12 | | codex (after) | 1 | 0 | 0 | 0 | 0 | # Additional Notes This was originally a `wolfi` migration PR, **but** those migrations were reverted [here](kagent-dev@88dabc0) because `wolfi` would not work cleanly with substrate (at least on arm64 environments, due to known gVisor issues google/gvisor#13542). --------- Signed-off-by: Fabian Gonzalez <[email protected]> (cherry picked from commit 8e1ff48)
teemow
added a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 10, 2026
The controller and Go ADK images are alpine:3.22 plus `apk add`; the base layer's libcrypto3/libssl3 3.5.7-r0 carry CVE-2026-14456 (HIGH, fixed in 3.5.8-r0). `apk upgrade --no-cache` before the add brings the runtime layer to the current Alpine packages, as kagent-dev#2756 did for the harness images.
teemow
added a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 10, 2026
The controller and Go ADK images are alpine:3.22 plus `apk add`; the base layer's libcrypto3/libssl3 3.5.7-r0 carry CVE-2026-14456 (HIGH, fixed in 3.5.8-r0). `apk upgrade --no-cache` before the add brings the runtime layer to the current Alpine packages, as kagent-dev#2756 did for the harness images.
teemow
added a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 10, 2026
| 2026-09-10 20:51 | `3dcfc28` | `4a91c27` (2026-09-10) | `5dd243a` → `c231bd6` | 9 | `c0125c5` Use `apk upgrade` on harness images (kagent-dev#2756) — merged upstream as `8e1ff48` | [run](https://github.com/giantswarm/kagent-upstream/actions/runs/34526022137) — checks red on the first candidate (carried MCPServer patch vs upstream kagent-dev#2774), fixed and landed by hand |
QuentinBisson
added a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 22, 2026
…drops the rows upstream merged Continuation re-read (kagent-dev#2823), the two controller metrics commits (kagent-dev#2886), the compaction cherry-picks (kagent-dev#2790) and the harness apk upgrade (kagent-dev#2756) leave the table; the chart's harness.compaction row joins it.
QuentinBisson
added a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 22, 2026
…drops the rows upstream merged Continuation re-read (kagent-dev#2823), the two controller metrics commits (kagent-dev#2886), the compaction cherry-picks (kagent-dev#2790) and the harness apk upgrade (kagent-dev#2756) leave the table; the chart's harness.compaction row joins it.
QuentinBisson
added a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 22, 2026
…drops the rows upstream merged Continuation re-read (kagent-dev#2823), the two controller metrics commits (kagent-dev#2886), the compaction cherry-picks (kagent-dev#2790) and the harness apk upgrade (kagent-dev#2756) leave the table; the chart's harness.compaction row joins it.
QuentinBisson
added a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 22, 2026
…drops the rows upstream merged Continuation re-read (kagent-dev#2823), the two controller metrics commits (kagent-dev#2886), the compaction cherry-picks (kagent-dev#2790) and the harness apk upgrade (kagent-dev#2756) leave the table; the chart's harness.compaction row joins it.
QuentinBisson
added a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 22, 2026
…drops the rows upstream merged Continuation re-read (kagent-dev#2823), the two controller metrics commits (kagent-dev#2886), the compaction cherry-picks (kagent-dev#2790) and the harness apk upgrade (kagent-dev#2756) leave the table; the chart's harness.compaction row joins it.
QuentinBisson
added a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Sep 24, 2026
…drops the rows upstream merged Continuation re-read (kagent-dev#2823), the two controller metrics commits (kagent-dev#2886), the compaction cherry-picks (kagent-dev#2790) and the harness apk upgrade (kagent-dev#2756) leave the table; the chart's harness.compaction row joins it.
QuentinBisson
pushed a commit
to giantswarm/kagent-upstream
that referenced
this pull request
Oct 5, 2026
The controller and Go ADK images are alpine:3.22 plus `apk add`; the base layer's libcrypto3/libssl3 3.5.7-r0 carry CVE-2026-14456 (HIGH, fixed in 3.5.8-r0). `apk upgrade --no-cache` before the add brings the runtime layer to the current Alpine packages, as kagent-dev#2756 did for the harness images.
pkothare
pushed a commit
to pkothare/kagent
that referenced
this pull request
Nov 13, 2026
# Description The sandbox-guest runtime image only ran `apk add`, so it shipped the Alpine base image's package versions as-is and showed more CVEs in image scans than the Claude and Codex harness images. Those images have run `apk upgrade` since kagent-dev#2756; the guest Dockerfile was added afterwards without it. This adds `apk upgrade --no-cache` before the package install, matching the harness images. Signed-off-by: timflannagan <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Resolves CVEs with
apk upgradeon harness images.Additional Notes
This was originally a
wolfimigration PR, but those migrations were reverted here becausewolfiwould not work cleanly with substrate (at least on arm64 environments, due to known gVisor issues google/gvisor#13542).