From 34f77decd6d96f564d95a9ef33d30da798ff4c99 Mon Sep 17 00:00:00 2001 From: Matt Collins Date: Thu, 5 Nov 2026 05:23:04 +0000 Subject: [PATCH] UID2-8267: Remove unused fontconfig and libexpat from image Remove the libexpat suppression. Co-Authored-By: Claude Sonnet 5.5 --- .trivyignore.rego | 12 ------------ Dockerfile | 5 ++++- 2 files changed, 4 insertions(+), 13 deletions(-) delete mode 100644 .trivyignore.rego diff --git a/.trivyignore.rego b/.trivyignore.rego deleted file mode 100644 index e8c125e..0000000 --- a/.trivyignore.rego +++ /dev/null @@ -1,12 +0,0 @@ -package trivy - -import rego.v1 - -default ignore := false - -# libexpat is a native OS library in the base image that the JVM never loads. -# Java XML parsing uses the JDK's pure-Java parsers. -ignore if { - input.PkgName == "libexpat" - startswith(input.PkgIdentifier.PURL, "pkg:apk/") -} diff --git a/Dockerfile b/Dockerfile index 92205f5..6900c67 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,9 @@ # sha from https://hub.docker.com/layers/library/eclipse-temurin/21.0.13_9-jre-alpine-3.23/images/sha256-5583e3116cba3393e885b70a4498fc961556fa42afa2d892ecffcd4f689e2107 FROM eclipse-temurin@sha256:5583e3116cba3393e885b70a4498fc961556fa42afa2d892ecffcd4f689e2107 +# Headless service: remove the unused font support (fontconfig brings libexpat, libpng and freetype) +RUN apk del --no-cache fontconfig ttf-dejavu + WORKDIR /app EXPOSE 8088 @@ -17,7 +20,7 @@ COPY ./run_tool.sh /app COPY ./conf/default-config.json /app/conf/ COPY ./conf/*.xml /app/conf/ -RUN apk add --no-cache --upgrade libpng libcrypto3 libssl3 musl musl-utils gnutls && addgroup --gid 1100 uidusers && adduser -D -G uidusers --uid 1100 uid2-optout && mkdir -p /opt/uid2 && chmod 755 -R /opt/uid2 && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads && mkdir -p /app/pod_terminating && chmod 777 -R /app/pod_terminating +RUN apk add --no-cache --upgrade libcrypto3 libssl3 musl musl-utils gnutls && addgroup --gid 1100 uidusers && adduser -D -G uidusers --uid 1100 uid2-optout && mkdir -p /opt/uid2 && chmod 755 -R /opt/uid2 && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads && mkdir -p /app/pod_terminating && chmod 777 -R /app/pod_terminating USER uid2-optout CMD java \