You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "tooptoop4 (via GitHub)" <gi...@apache.org> on 2024/10/22 23:47:54 UTC
[I] superset helm uses dockerize image which is unsupported (last release 7 years ago) and has CVEs [superset]
tooptoop4 opened a new issue, #23103:
URL: https://github.com/apache/superset/issues/23103
https://github.com/apache/superset/releases/download/superset-helm-chart-0.8.6/superset-0.8.6.tgz has references to jwilder/dockerize image/commands
https://github.com/jwilder/dockerize shows no new release for many years
following tools/CVEs are found within the dockerize image:
busybox 1.26.2-r4 has
CVE-2015-9261
CVE-2017-15873
CVE-2017-16544
CVE-2018-1000500
CVE-2018-1000517
CVE-2018-20679
CVE-2019-5747
CVE-2021-42376
CVE-2021-42378
CVE-2021-42379
CVE-2021-42381
CVE-2021-42382
CVE-2021-42384
CVE-2021-42385
CVE-2021-42386
CVE-2022-28391
musl 1.1.16-r9 has
CVE-2017-15650
CVE-2019-14697
CVE-2020-28928
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 6 years ago) and has CVEs [superset]
Posted by "villebro (via GitHub)" <gi...@apache.org>.
villebro commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-2152938002
@mistercrunch I agree, this would be much cleaner and easier to reason about. Another alternative would be to have a few new scripts (similar to `superset_init.sh`) for checking metastore/cache readiness, and then just use the superset image to avoid pulling in `busybox` (after all, it'll already be available). But I don't see `busybox` going sour or bloating anytime soon, so I think this is a really good approach.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 7 years ago) and has CVEs [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #23103: superset helm uses dockerize image which is unsupported (last release 7 years ago) and has CVEs
URL: https://github.com/apache/superset/issues/23103
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 7 years ago) and has CVEs [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
mistercrunch commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-2813347309
Can't allocate time personally, but someone should tackle.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 7 years ago) and has CVEs [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-4530300564
@villebro @sha174n @dpgaspar might be best qualified to handle this. Maybe we can point to a Chainguard imare or something.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 7 years ago) and has CVEs [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-4035389946
Can anyone confirm whether the current Helm chart has been updated to replace the old `dockerize` image? @rusackas asked this in July 2025. If it's been updated, this can be closed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 6 years ago) and has CVEs [superset]
Posted by "dpgaspar (via GitHub)" <gi...@apache.org>.
dpgaspar commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-1930278279
> @tooptoop4 I see https://github.com/jwilder/dockerize has merged PRs into the repo more recently now and its most recent release seems to be in May 2023. Is this still a concern or can this issue be closed?
Still a concern, we should eventually remove this dependency, I think we just use it to test PG and redis availability on helm
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 6 years ago) and has CVEs [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
mistercrunch commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-2152792148
While working on docker-related things I remember thinking "what does this do!?", and it's something about waiting for services to get up before starting other services. Asking GPT there are drop-in replacements like `wait-for-it` and `dockerize-golang` but given our experience with dockerize, I think the best would be to go helm or k8s-native with something like:
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: superset
spec:
replicas: 1
template:
metadata:
labels:
app: superset
spec:
initContainers:
- name: wait-for-db
image: busybox
command: ['sh', '-c', 'until nc -z db 5432; do echo waiting for db; sleep 2; done;']
- name: wait-for-redis
image: busybox
command: ['sh', '-c', 'until nc -z redis 6379; do echo waiting for redis; sleep 2; done;']
containers:
- name: superset
image: apache/superset:latest
ports:
- containerPort: 8088
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 7 years ago) and has CVEs [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-2813294335
@mistercrunch @tooptoop4 is this still something anyone intends to tackle, or shall we close it as 'not planned'? It's been untouched for about half a year now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 6 years ago) and has CVEs [superset]
Posted by "sfirke (via GitHub)" <gi...@apache.org>.
sfirke commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-1930229225
@tooptoop4 I see https://github.com/jwilder/dockerize has merged PRs into the repo more recently now and its most recent release seems to be in May 2023. Is this still a concern or can this issue be closed?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 7 years ago) and has CVEs [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-4537470171
Closing in favor of #40424, which captures the current state with a fresh trivy scan and a concrete proposal.
Quick summary of what changed since this was opened in Feb 2023:
- The chart no longer uses the upstream `jwilder/dockerize` image — it's been on `apache/superset:dockerize` (Superset-built) for a while. So the *specific* concern (3rd-party unmaintained image) is addressed.
- However, today's trivy scan of the current published `apache/superset:dockerize` shows we've taken on the maintenance burden and haven't kept up:
| | |
|---|---|
| Image created | 2024-05-09 |
| Base | Alpine 3.19.1 (EOSL) |
| CRITICAL | 3 |
| HIGH | 25 |
| MEDIUM | 71 |
| LOW | 24 |
| Fixes available | 123/123 |
64 of the CVEs are in the `dockerize` Go binary itself (stale Go stdlib + vendored `golang.org/x/{net,crypto}`); the rest are alpine base packages.
Rather than rebuild a single-purpose image on a fresher base (kicks the can again), #40424 proposes dropping `dockerize` from the chart entirely and replacing the four init-container TCP waits with a bash `/dev/tcp` probe against the superset image we're already pulling. Zero new images, no external deps, no CVE backlog separate from the main image's.
Thanks to everyone who weighed in here over the past three years — the proposal in #40424 is essentially @villebro's suggestion from June 2024 with a concrete migration plan.
🦕
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 7 years ago) and has CVEs [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-3120741637
Is this still the case with the current Helm chart?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 7 years ago) and has CVEs [superset]
Posted by "bouhalimedaziz (via GitHub)" <gi...@apache.org>.
bouhalimedaziz commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-4529285647
@rusackas I took a look at the current helm/superset/values.yaml on master, the initImage is using repository: apache/superset with tag: dockerize, so it's no longer pointing to the old jwilder/dockerize image. That said, dockerize itself is still there, just maintained by the Superset team now rather than fully replaced with a k8s-native approach like proposed in earlier messages.
https://github.com/apache/superset/blob/master/helm/superset/values.yaml
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 6 years ago) and has CVEs [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-2145688992
Does anyone here (cc @mistercrunch) know of any viable alternatives?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 6 years ago) and has CVEs [superset]
Posted by "tooptoop4 (via GitHub)" <gi...@apache.org>.
tooptoop4 closed issue #23103: superset helm uses dockerize image which is unsupported (last release 6 years ago) and has CVEs
URL: https://github.com/apache/superset/issues/23103
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 6 years ago) and has CVEs [superset]
Posted by "tooptoop4 (via GitHub)" <gi...@apache.org>.
tooptoop4 commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-2423503866
🦕
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] superset helm uses dockerize image which is unsupported (last release 7 years ago) and has CVEs [superset]
Posted by "plaes (via GitHub)" <gi...@apache.org>.
plaes commented on issue #23103:
URL: https://github.com/apache/superset/issues/23103#issuecomment-4097601369
> Can anyone confirm whether the current Helm chart has been updated to replace the old `dockerize` image? [@rusackas](https://github.com/rusackas) asked this in July 2025. If it's been updated, this can be closed.
Still broken as today when using with default values:
```
failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: exec: "/bin/sh": stat /bin/sh: no such file or directory
```
Apparently this image has been updated meanwhile and also rewritten to use go which breaks the startup as there's no `/bin/sh` present.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org