Fix CVEs: install gosu from GitHub release instead of Debian package (Go 1.19.8 → current)

2026-04-10 20:20:12 +02:00
parent 73e94c7e54
commit 18e55aeb18
1 changed files with 7 additions and 1 deletions
@@ -31,13 +31,19 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    less \
    vim-tiny \
    sudo \
-    gosu \
    locales \
    procps \
    unzip \
    && ln -s /usr/bin/fdfind /usr/local/bin/fd \
    && rm -rf /var/lib/apt/lists/*

+# ── gosu (install from GitHub for current Go version, avoids CVEs in Debian package)
+ARG GOSU_VERSION=1.17
+RUN ARCH=$(case "${TARGETARCH}" in amd64) echo "amd64" ;; arm64) echo "arm64" ;; *) echo "amd64" ;; esac) && \
+    curl -fsSL "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${ARCH}" -o /usr/local/bin/gosu && \
+    chmod +x /usr/local/bin/gosu && \
+    gosu --version
+
 # Set locale
 RUN sed -i '/en_US.UTF-8/s/^# //g' /etc/locale.gen && locale-gen
 ENV LANG=en_US.UTF-8