Skip to content

chore!: Remove wget from Promtail docker image #15101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 27, 2024
Merged

chore!: Remove wget from Promtail docker image #15101

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Remove wget from Promtail docker image 
The package has been added to the Docker image with PR #11711 with the
intention to support the Docker healthcheck.

However, to reduce the attack surface of our Docker images, we want to
keep them as slim as possible. The current version of Promtail (3.3.0)
for example contains a wget version with vulnerability
[CVE-2024-38428](https://security-tracker.debian.org/tracker/CVE-2024-38428).

The healthcheck can be achieved by other means, e.g.

1. Extend the `grafana/promtail` base image and add `wget` using `apt
   install wget`
   #11590 (comment)
2. Use low-level `/dev/tcp/127.0.0.1:9080` to establish a connection and
   check the exit code
   #11590 (comment)

Signed-off-by: Christian Haudum <christian.haudum@gmail.com>
  • Loading branch information
@chaudum
chaudum committed Nov 25, 2024
commit 33fc5f0306426ce65c54fae444f55061f9ad5f60
2 changes: 1 addition & 1 deletion clients/cmd/promtail/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ RUN make clean && make BUILD_IN_CONTAINER=false PROMTAIL_JOURNAL_ENABLED=true pr
FROM debian:12.8-slim
# tzdata required for the timestamp stage to work
RUN apt-get update && \
apt-get install -qy tzdata ca-certificates wget libsystemd-dev && \
apt-get install -qy tzdata ca-certificates libsystemd-dev && \
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail
COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml
Expand Down
Loading