Provide regular updates of Docker images (was: CVE's CBL-Mariner) about openjdk-docker HOT 8 CLOSED

@brunoborges @karianna

I believe this can be closed. Automated process checks twice per day for changes in the base image digest. Once a detected changes occurs the image build pipeline is executed, and changes pushed.

from openjdk-docker.

This is a good question. We don't currently rebuild the base images until a new OpenJDK release is available. We likely need to listen to changes in the base images and rebuild when they do.

from openjdk-docker.

@milderhc can we listen in on security pointy releases of Linux distributions? Intriguing thought.

from openjdk-docker.

Is this something we can expect to be solved in the near future?
We are relying heavily on this image and it generates a lot of High Findings in Azure Security portal.

from openjdk-docker.

Is this something we can expect to be solved in the near future? We are relying heavily on this image and it generates a lot of High Findings in Azure Security portal.

Thanks for your patience! We're discussing this internally so we can put out a public policy and will respond back here in the next week or so.

from openjdk-docker.

We can certainly create a scheduled trigger in our GH/AzDO that would simply inspect the CBL-Mariner releases and take action if a release we've not seen before shows up. I'll see if I can rig something up in the next few days.

from openjdk-docker.

@d3r3kk mind if we keep this issue open until this is addressed?

from openjdk-docker.

We will update weekly, starting on or before the July PSU 2022.

from openjdk-docker.