dce975bf4e
Pin OpenBao base image from unpinned :2 tag to :2.5.0 (latest stable, released 2026-02-04) in both the Dockerfile and the dev docker-compose. CVEs resolved: - CVE-2025-68121 (CRITICAL): Go stdlib crypto/tls session resumption - CVE-2024-8185 (HIGH): DoS via Raft join requests - CVE-2024-9180 (HIGH): Root namespace privilege escalation - CVE-2025-59043 (HIGH): DoS via malicious JSON - CVE-2025-64761 (HIGH): Identity group root escalation All fixed in OpenBao >= 2.4.4; v2.5.0 includes all patches plus new features (horizontal read scalability, OCI plugin distribution). Files changed: - docker/openbao/Dockerfile: FROM tag 2 -> 2.5.0 - docker/docker-compose.yml: openbao + openbao-init image tags 2 -> 2.5.0 The production/swarm compose files use the custom-built git.mosaicstack.dev/mosaic/stack-openbao image which is built FROM this Dockerfile, so they inherit the fix on next CI build. Fixes #363
20 lines
547 B
Docker
20 lines
547 B
Docker
FROM quay.io/openbao/openbao:2.5.0
|
|
|
|
LABEL maintainer="Mosaic Stack <dev@mosaic.local>"
|
|
LABEL description="OpenBao secrets management for Mosaic Stack"
|
|
|
|
# Copy OpenBao configuration
|
|
COPY config.hcl /openbao/config/config.hcl
|
|
|
|
# Copy auto-initialization script
|
|
COPY init.sh /openbao/init.sh
|
|
RUN chmod +x /openbao/init.sh
|
|
|
|
# Expose OpenBao port
|
|
EXPOSE 8200
|
|
|
|
# Use the default entrypoint from the base image
|
|
# The container will be started with either:
|
|
# - Default: openbao server -config=/openbao/config/config.hcl
|
|
# - Init sidecar: /openbao/init.sh
|