Skip to content

Fix Compose x/net in the published devcontainer #330

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rmcdaniel merged 1 commit into from
Nov 8, 2026
Merged

Fix Compose x/net in the published devcontainer #330

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .devcontainer/docker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
FROM node:22.23.4-bookworm-slim@sha256:4b150b48b4116e2a22f2c39cc27025fbf4f153e2078fd3b14d159fdb5c7279da AS node

Check warning on line 1 in .devcontainer/docker/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=durable-workflow_sample-app&issues=AaG8-RPSkL7yTWvgxNEW&open=AaG8-RPSkL7yTWvgxNEW&pullRequest=330

FROM composer:2.11.0@sha256:278dfc7bd35169965d03f87194816f43bf4e6b6ea61707c2114e52ad12fe24ce AS composer

Check warning on line 3 in .devcontainer/docker/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=durable-workflow_sample-app&issues=AaG8-RPSkL7yTWvgxNEX&open=AaG8-RPSkL7yTWvgxNEX&pullRequest=330

FROM php:8.4.27-cli-bookworm@sha256:b3e907a1108629c562c4bb313ce3449e34d49991f6bb2487913f6146f47200fe AS brotli-build

Check warning on line 5 in .devcontainer/docker/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=durable-workflow_sample-app&issues=AaG8-RPSkL7yTWvgxNEY&open=AaG8-RPSkL7yTWvgxNEY&pullRequest=330

COPY .central-apt-source/docker/apt/require-fixed-bookworm-apt.sh /usr/local/share/sample-app/require-fixed-bookworm-apt.sh
COPY --from=composer /usr/bin/composer /usr/local/bin/composer
Expand All @@ -16,9 +16,9 @@
&& /out/verify-system-brotli \
&& cp /usr/src/brotli-inputs/version /usr/src/brotli-inputs/install-vendor.sh /usr/src/brotli-inputs/verify-runtime.php /out/

FROM docker:29.9.2-cli@sha256:5e6baf67325a79f64ed3bed6863954d5e05d0f3d4e57cbdb14809346814bbfdb AS docker-cli

Check warning on line 19 in .devcontainer/docker/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=durable-workflow_sample-app&issues=AaG8-RPSkL7yTWvgxNEZ&open=AaG8-RPSkL7yTWvgxNEZ&pullRequest=330

FROM golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 AS go-tools

Check warning on line 21 in .devcontainer/docker/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=durable-workflow_sample-app&issues=AaG8-RPSkL7yTWvgxNEa&open=AaG8-RPSkL7yTWvgxNEa&pullRequest=330

ENV CGO_ENABLED=0 GOTOOLCHAIN=local
COPY docker/go-tools/compose-go-net.patch /tmp/compose-go-net.patch
Expand All @@ -43,13 +43,13 @@
git apply --unidiff-zero --check /tmp/compose-go-net.patch; \
git apply --unidiff-zero /tmp/compose-go-net.patch; \
go build -mod=readonly -trimpath \
-ldflags='-s -w -X github.com/docker/compose/v5/internal.Version=5.6.1+sample.1' \
-ldflags='-s -w -X github.com/docker/compose/v5/internal.Version=5.6.1+sample.2' \
-buildvcs=false -o /out/docker-compose ./cmd; \
go mod verify; \
go version -m /out/docker-compose; \
/out/docker-compose version

FROM rust:1.99.1-slim-bookworm@sha256:24707e70a4f1e23d9a7b25202ec43126d28a52294b96aad5c670df1fd1f1d400 AS rust

Check warning on line 52 in .devcontainer/docker/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=durable-workflow_sample-app&issues=AaG8-RPSkL7yTWvgxNEb&open=AaG8-RPSkL7yTWvgxNEb&pullRequest=330

RUN set -eux; \
rm -rf /usr/local/rustup/downloads /usr/local/rustup/tmp; \
Expand All @@ -59,9 +59,9 @@
rustc --version; \
cargo --version

FROM mariadb:11.4.13@sha256:d1891ede5a559f1086f55053bb8cc1569b0298338c4d72d71725a7f74f6ba620 AS mysql-seed

Check warning on line 62 in .devcontainer/docker/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=durable-workflow_sample-app&issues=AaG8-RPSkL7yTWvgxNEc&open=AaG8-RPSkL7yTWvgxNEc&pullRequest=330

ENV MYSQL_ROOT_PASSWORD=password \

Check warning on line 64 in .devcontainer/docker/Dockerfile

View workflow job for this annotation

GitHub Actions / Qualify candidate linux/arm64

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "MYSQL_PASSWORD")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 64 in .devcontainer/docker/Dockerfile

View workflow job for this annotation

GitHub Actions / Qualify candidate linux/arm64

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "MYSQL_ROOT_PASSWORD")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 64 in .devcontainer/docker/Dockerfile

View workflow job for this annotation

GitHub Actions / Qualify candidate linux/amd64

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "MYSQL_PASSWORD")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 64 in .devcontainer/docker/Dockerfile

View workflow job for this annotation

GitHub Actions / Qualify candidate linux/amd64

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "MYSQL_ROOT_PASSWORD")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
MYSQL_ROOT_HOST=% \
MYSQL_DATABASE=sample \
MYSQL_USER=laravel \
Expand Down Expand Up @@ -129,7 +129,7 @@
.; \
test -s /tmp/sample-app-mysql-seed.tar

FROM php:8.4.27-cli-bookworm@sha256:b3e907a1108629c562c4bb313ce3449e34d49991f6bb2487913f6146f47200fe

Check warning on line 132 in .devcontainer/docker/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Use either the version tag or the digest for the image instead of both. 


See more on https://sonarcloud.io/project/issues?id=durable-workflow_sample-app&issues=AaG8-RPSkL7yTWvgxNEd&open=AaG8-RPSkL7yTWvgxNEd&pullRequest=330

COPY .central-apt-source/docker/apt/require-fixed-bookworm-apt.sh /usr/local/share/sample-app/require-fixed-bookworm-apt.sh
COPY --from=brotli-build /out /usr/local/share/sample-app/brotli
Expand Down
2 changes: 1 addition & 1 deletion .devcontainer/docker/verify-image.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ rm -rf "$python_probe_dir"
[[ "$(cargo --version | awk '{print $2}')" == "1.99.1" ]]
[[ "$(docker --version | sed -E 's/^Docker version ([^,]+),.*/\1/')" == "29.9.2" ]]
compose_version="$(docker compose version --short)"
[[ "${compose_version#v}" == "5.6.1+sample.1" ]]
[[ "${compose_version#v}" == "5.6.1+sample.2" ]]
[[ "$(npm --version)" == "12.2.1+sample.1" ]]
[[ "$(gosu --version)" == '1.20 (go1.27.3 on linux/'* ]]
cli_version="${DURABLE_WORKFLOW_CLI_VERSION:-$(php -r '$tuple = json_decode(file_get_contents("/usr/local/share/sample-app/qualified-artifact-tuple.json"), true, flags: JSON_THROW_ON_ERROR); echo $tuple["artifacts"]["cli"];')}"
Expand Down
12 changes: 7 additions & 5 deletions docker/go-tools/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,13 @@ Go 1.27.3 image on each native image-builder architecture. Source archives are
SHA-256 checked before extraction; module downloads retain Go checksum checks,
and compilation uses `-mod=readonly`, `CGO_ENABLED=0` and `GOTOOLCHAIN=local`.

Upstream Compose 5.6.1 still embeds `golang.org/x/net` 0.58.0, affected by
CVE-2026-78669. The zero-context patch upgrades it to 0.60.0 and the minimum
required `x/crypto` 0.57.0 / `x/text` 0.42.0 module versions, with recorded
`go.sum` checksums. The exact upstream archive hash protects the patch base.
The resulting Compose version is explicitly `5.6.1+sample.1`.
Upstream Compose 5.6.1 still embeds `golang.org/x/net` 0.58.0. The
zero-context patch selects 0.62.0, fixing CVE-2026-78669 and the HTML-parser
CVE-2026-78661. Its dependency closure selects `x/crypto` 0.58.0, `x/sys`
0.49.0, `x/term` 0.47.0, `x/text` 0.43.0 and `x/sync` 0.24.0, with recorded
`go.sum` checksums from the public Go checksum database. The exact upstream
archive hash protects the patch base. The resulting Compose version is
explicitly `5.6.1+sample.2`.

Upstream gosu 1.20 fixes its user parser through `moby/sys/user` 0.4.1, but its
prebuilt assets still use Go 1.24.6. Building the unchanged source with the current
Expand Down
39 changes: 27 additions & 12 deletions docker/go-tools/compose-go-net.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,37 @@
--- a/go.mod
+++ b/go.mod
@@ -53,2 +53,2 @@
- golang.org/x/sync v0.23.0
- golang.org/x/sys v0.48.0
+ golang.org/x/sync v0.24.0
+ golang.org/x/sys v0.49.0
@@ -121,3 +121,3 @@
- golang.org/x/crypto v0.56.0 // indirect
- golang.org/x/net v0.58.0 // indirect
- golang.org/x/text v0.41.0 // indirect
+ golang.org/x/crypto v0.57.0 // indirect
+ golang.org/x/net v0.60.0 // indirect
+ golang.org/x/text v0.42.0 // indirect
+ golang.org/x/crypto v0.58.0 // indirect
+ golang.org/x/net v0.62.0 // indirect
+ golang.org/x/text v0.43.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -299,0 +300,2 @@
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
@@ -303,0 +306,2 @@
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
@@ -313,0 +318 @@
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
@@ -315,0 +321,2 @@
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
+golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
@@ -305,0 +310,2 @@
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
@@ -311,0 +318,2 @@
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
@@ -313,0 +322,2 @@
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
@@ -315,0 +326,2 @@
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
@@ -317,0 +330,2 @@
+golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
+golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
Loading