From f5e914ea03f71e0b3a3642420f763cd8d1b27387 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Tue, 8 Sep 2026 14:59:49 +0000 Subject: [PATCH] Move CLI image base to digest-pinned SUSE BCI micro 15.7 gcr.io/distroless/static-debian11 is end-of-life. Trivy reports Metadata.OS.EOSL=true and warns that detection is insufficient because Debian 11 no longer receives security updates, so a clean scan on that base was partly a dead advisory feed rather than a clean image. Five tzdata advisories sat below the dev gate only because the gate filters UNKNOWN severity. registry.suse.com/bci/bci-micro:15.7 is SLES 15-SP7 with a live SUSE feed, publishes both linux/amd64 and linux/arm64/v8, and needs no package installation, so no zypper step is introduced. The digest is the multi-arch index digest so both GoReleaser per-arch builds resolve it under --platform. --- docker/Dockerfile.goreleaser | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docker/Dockerfile.goreleaser b/docker/Dockerfile.goreleaser index 83ed3cf8..2ab24459 100644 --- a/docker/Dockerfile.goreleaser +++ b/docker/Dockerfile.goreleaser @@ -1,3 +1,5 @@ -FROM gcr.io/distroless/static-debian11 +# Pinned to the multi-arch index digest, not a per-arch one, so the amd64 and +# arm64v8 GoReleaser builds can both resolve it via --platform. +FROM registry.suse.com/bci/bci-micro:15.7@sha256:44f5c047210188eb290414c52f883b763efa1e234c2a15c325f03e83f0984fa6 ENTRYPOINT ["/usr/bin/sts"] -COPY sts /usr/bin/sts \ No newline at end of file +COPY sts /usr/bin/sts