From 346fc0d5c49e3a70187bc2f7709b533682ebf7b0 Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Tue, 13 Oct 2026 14:16:38 +0300 Subject: [PATCH] Apply Ubuntu security updates when building the Docker image Dockerfile-alpine runs apk upgrade, but the Ubuntu Dockerfile installs packages without upgrading the ones eclipse-temurin ships. Its image gets Ubuntu security fixes only after eclipse-temurin rebuilds its base image, so a build in between carries the old packages: Trivy flags openssl 3.0.13-0ubuntu3.11 in the released image, fixed in 3.16. --- opendj-packages/opendj-docker/Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/opendj-packages/opendj-docker/Dockerfile b/opendj-packages/opendj-docker/Dockerfile index 7fc614515b..e0a549a82b 100644 --- a/opendj-packages/opendj-docker/Dockerfile +++ b/opendj-packages/opendj-docker/Dockerfile @@ -57,6 +57,7 @@ WORKDIR /opt RUN printf 'Acquire::ForceIPv4 "true";\nAcquire::Retries "5";\n' > /etc/apt/apt.conf.d/99-ci-network \ && apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \ && apt-get install -y --no-install-recommends curl unzip \ && if [ -z "$VERSION" ] ; then VERSION="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenDJ/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)"; fi \ && if [ ! -f "$OPENDJ_DIST_FILENAME" ]; then echo file exists && curl -L https://github.com/OpenIdentityPlatform/OpenDJ/releases/download/$VERSION/opendj-$VERSION.zip --output $OPENDJ_DIST_FILENAME; fi \