[gtopper]

Description

IG-25353

Fixes the critical and high vulnerabilities reported for the frames image (frames:0.13.13) as part of the 3.7.4 security update (IG-25353, IG-25298, IG-25299).

The main cause was the Dockerfile. It had a single stage, so the released image was the whole golang:1.24-alpine build image: the Go toolchain, the module cache, the source tree, and the framesd binary three times over (including a stray framesd-v0.13.13-linux-amd64 from the release job's make frames-bin). The toolchain alone accounted for 20 critical and 480 high findings.

Changes

• Two-stage Dockerfile. framesd is built in golang:1.27-alpine with CGO_ENABLED=0. Only the binary is copied into alpine:3.24, which runs apk upgrade at build time.
  • bash stays in the runtime image, because the platform starts the container via /bin/bash (see IG-23283 and Add bash to image because containerd expects it to be present #673).
  • The released binary was already built with CGO_ENABLED=0. Setting it explicitly keeps the same behavior (static binary, pure-Go DNS resolver), and it can't clash with the runtime image's libc.
  • go.mod/go.sum are copied and downloaded before the source, so the module download is cached as a separate layer.
• Go 1.27. Go 1.24 no longer gets security fixes, and several stdlib fixes are only available in 1.26.10+/1.27.3+. CI (pr.yaml, release.yaml) is updated to match.
• Go dependencies:
  • google.golang.org/grpc 1.79.3 → 1.85.0
  • golang.org/x/net 0.48.0 → 0.62.0
  • golang.org/x/text 0.32.0 → 0.43.0
  • github.com/valyala/fasthttp 1.44.0 → 1.77.0
  • github.com/klauspost/compress 1.15.9 → 1.20.3
  • fasthttp 1.77.0 replaced github.com/andybalholm/brotli (vulnerable 1.0.4) with github.com/molecule-man/go-brrr, so brotli is no longer a dependency.
• Release workflow. Removed the release-docker-internal job, which pushed to the defunct IGZ Artifactory (artifactory.iguazeng.com:6555). The PyPI job now depends on release-docker, so it no longer waits on that push. The platform pulls frames from gcr.io/iguazio (dockerRepos.iguazio_b in avrez-manifest), and 3.7.4 and 3.8.0 resolve ~0.13.0. Releasing 0.13.14 is therefore enough, with no avrez-manifest change.
• .dockerignore / .gitignore. Local config, build outputs, IDE files and the Python client are kept out of the build context. Local config and build outputs are also kept out of git. The patterns are anchored to the repo root, so cmd/framesd/ isn't affected.

Trivy scan

Trivy 0.76.1, critical/high only:

Image	OS	Go	Critical	High
gcr.io/iguazio/frames:0.13.13	Alpine 3.23.0	1.24.11	28	607

The new image has no findings at any severity. Image size went from 1.09 GB to 61.7 MB.

Testing

On a local build of the image:

• framesd starts with config_example.yaml, and the HTTP (8080), gRPC (8081) and profiling (8082) servers listen.
• /bin/bash is present and works.
• An HTTPS request from inside the container succeeds, using the stock Alpine CA bundle.
• /usr/local/go, /go and /frames are absent, and /usr/local/bin/framesd is the only framesd file.
• go version -m shows go1.27.3 with CGO_ENABLED=0, and ldd reports a static binary.