Update distroless nodejs image #1224
Conversation
🦋 Changeset detectedLatest commit: bbff592 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
There was a problem hiding this comment.
Should we autopatch this or just tell consumers to? 🤷
There was a problem hiding this comment.
We probably need to agree on a more systematic approach for introducing and later retiring custom patches like this, but makes a lot of sense here 👍
There was a problem hiding this comment.
Re this, I'm thinking maybe with every major version we retire custom patches. Somewhere in the readme we should add a section on upgrading and suggest that consumers go up major version's one at a time perhaps?
There was a problem hiding this comment.
We probably need to agree on a more systematic approach for introducing and later retiring custom patches like this, but makes a lot of sense here 👍
The current image has these vulnerabilities flagged in ECR but the new
-debian11image is free from them.For whatever reason, this image isn't using the latest deps/libs? I haven't quite looked at why but the documentation now recommends
gcr.io/distroless/nodejs18-debian11by defaulthttps://github.com/GoogleContainerTools/distroless/blob/main/nodejs/README.md