Docker scan produces 331 vulnerabilities #147

Activity

1. conradwt commented on Mar 16, 2021

   

   conradwt

   on Mar 16, 2021

   More actions

   @mjmaurer I'm seeing similar numbers in regards to elixir:1.11.4 but many of these vulnerabilities are coming from dependencies included in the image. Thus, I recommend using a different image that works for your use case. For example

   $ docker scan elixir:1.11.4-alpine  
   
   ...
   
   Tested 22 dependencies for known vulnerabilities, found 1 vulnerability.
   

   Note: The one vulnerability here is as follows:

   Medium severity vulnerability found in musl/musl
   

   $ docker scan elixir:1.11.4-slim
   
   ...
   
   Tested 96 dependencies for known vulnerabilities, found 63 vulnerabilities.
   

   In general, one can reduce the level of security vulnerabilities by selecting an image that doesn't include unnecessary dependencies like alpine or slim.

   👍React with 👍1Reacted by Michael Maurer