Security fix: Update alpine base image to 3.7 about distribution-library-image HOT 7 OPEN

The PR is already open pretty long.
I've created a fixed build at quay.io:

docker pull quay.io/usr42/registry:latest

You can get details about the build at https://quay.io/usr42/registry:latest

I've already created a build for alpine:3.7:

docker pull quay.io/usr42/registry:upgrade_alpine_3.7

from distribution-library-image.

I guess we should change title to "Security fix: Update alpine base image to 3.7".

from distribution-library-image.

@mlowicki Good point. I've changed the title.
Unfortunately, my feeling is, there will be no reaction either way 👎

from distribution-library-image.

@dmcgowan any thoughts?

from distribution-library-image.

We update the alpine versions with releases of the registry. If you have found a vulnerability that effects the registry or the registry image, please email [email protected]. This doesn't look like a CVE that has an impact on the registry, but I will defer to @tianon on what the policy is on updating base images for official based on security scan results.

from distribution-library-image.

@dmcgowan @tianon maybe docker images should have explicit aliases to different version of Alpine so it would be something to choose an ease the migration?

from distribution-library-image.

@usr42 you can try https://github.com/operasoftware/docker-registry-image instead (https://hub.docker.com/r/operasoftware/registry/).

from distribution-library-image.