Use secure base image

[stevehipwell]

This project looks great @max-rocket-internet but would it be possible to switch to a more secure base image such as one of the Chainguard images or distroless?

It might also be worth looking at building the image with ko?

Let me know if you'd be interested in a PR to add a GH Actions based workflow to do any this?

[max-rocket-internet]

Hi @stevehipwell 👋

but would it be possible to switch to a more secure base image

Sure, like the idea, PRs welcome!

such as one of the Chainguard images or distroless?

Probably a "no" on Chainguard. I've never heard of it and it looks like a relatively unknown project based on Github metrics.

Yes on distroless though 👍

It might also be worth looking at building the image with ko?
Let me know if you'd be interested in a PR to add a GH Actions based workflow to do any this?

Sure, PRs welcome :)

[stevehipwell]

Probably a "no" on Chainguard. I've never heard of it and it looks like a relatively unknown project based on Github metrics.

You might want to take a closer look at Chainguard and their images; full transparency, zero CVEs, signed, SBOMs & founded by the original creators of the distroless images. For cross referencing you will see multiple mentions in CNCF & OpenSSF security documentation/news as well as in all of the general tech news.

[nathanmcgarvey-modopayments]

Not sure if this is welcome here (if not, no worries): #23

Just updated to be a FROM scratch with some relevant build improvements (E.g. including an SBOM) if you're interested. (not using ko, though... just Docker)

[max-rocket-internet]

Thanks @nathanmcgarvey-modopayments for the PRs. These changes are now released in https://github.com/max-rocket-internet/k8s-event-logger/releases/tag/2.0 and in new chart version here

[stevehipwell]

@max-rocket-internet is there a reason you're not using <major>.<minor>.<patch> semver versions?

[max-rocket-internet]

@stevehipwell this project has only had 2 significant updates in the last 4 years and I don't see scope for much more change (because it's so simple). If more changes/contributions were coming I would probably set up CI/CD, other bits and think about version structure but for now I just made up the version tag.

[stevehipwell]

@max-rocket-internet with Dependabot you're likely to get more changes now and having the patch will likely be useful. You can always publish the image with a <major>.<minor> tag too.