Merge pull request #949 from haroonc/update-os

Update OS packages to patch builders.

bazel/Dockerfile

@@ -43,6 +43,13 @@ RUN \
       stable edge" && \
     apt-get -y update && \
     apt-get install -y docker-ce=${DOCKER_VERSION} docker-ce-cli=${DOCKER_VERSION} unzip && \
+    apt-get dist-upgrade -y && \
+    rm -rf \
+       /var/cache/debconf/* \
+       /var/lib/apt/lists/* \
+       /var/log/* \
+       /tmp/* \
+       /var/tmp/*  && \
 
     mv /usr/bin/bazel /builder/bazel           && \
     mv /builder/bazel.sh /usr/bin/bazel        && \

curl/Dockerfile

@@ -1,3 +1,10 @@
 FROM gcr.io/gcp-runtimes/ubuntu_20_0_4
+RUN apt-get update && apt-get dist-upgrade -y && \
+    rm -rf \
+       /var/cache/debconf/* \
+       /var/lib/apt/lists/* \
+       /var/log/* \
+       /tmp/* \
+       /var/tmp/* 
 COPY notice.sh /usr/bin
 ENTRYPOINT ["/usr/bin/notice.sh"]

gcloud/Dockerfile.slim

@@ -1,7 +1,7 @@
 FROM gcr.io/gcp-runtimes/ubuntu_20_0_4
 
 RUN apt-get -y update && \
-    apt-get -y upgrade && \
+    apt-get dist-upgrade -y && \
     apt-get -y install gcc python2.7 python-dev python3-pip wget ca-certificates \
        # These are necessary for add-apt-respository
        software-properties-common && \

gke-deploy/Dockerfile

@@ -12,6 +12,7 @@ RUN gcloud -q components install gsutil
 RUN gcloud -q components install kustomize
 RUN gcloud -q components install nomos
 RUN gcloud -q components install local-extract
+RUN apk update && apk upgrade --available --no-cache
 RUN apk -q --no-cache add gettext
 RUN apk -q --no-cache add yq
 

go/Dockerfile.alpine

@@ -2,14 +2,15 @@ ARG VERSION=1.15
 FROM golang:${VERSION}-alpine
 
 # Install VCS tools to support "go get" commands and install gcc.
-RUN apk add --update --no-cache git mercurial subversion build-base
+RUN apk update && apk upgrade --available --no-cache && \
+    apk add --update --no-cache git mercurial subversion build-base
 
 # We blank out the GOPATH because the base image sets it, and
 # if the user of this build step does *not* set it, we want to
 # explore other options for workspace derivation.
 ENV GOPATH=
 
-RUN mkdir /builder
+RUN mkdir /builder 
 
 COPY go_workspace.go prepare_workspace.inc /builder/
 

go/Dockerfile.debian

@@ -2,7 +2,7 @@ ARG VERSION=1.15
 FROM golang:${VERSION}
 
 # Install VCS tools to support "go get" commands and install gcc.
-RUN apt-get update -qqy && apt-get install -qqy git mercurial subversion gcc
+RUN apt-get update -qqy && apt-get dist-upgrade -yq && apt-get install -qqy git mercurial subversion gcc
 
 # We blank out the GOPATH because the base image sets it, and
 # if the user of this build step does *not* set it, we want to

gradle/Dockerfile

@@ -18,7 +18,7 @@ RUN \
    sed -i 's|security.debian.org|archive.debian.org/debian-security/|g' /etc/apt/sources.list && \
    sed -i '/stretch-updates/d' /etc/apt/sources.list
 
-RUN apt-get update -qqy && apt-get install -qqy curl \
+RUN apt-get update -qqy && apt-get dist-upgrade -yq && apt-get install -qqy curl \
   && mkdir -p /usr/share "${GRADLE_USER_HOME}" \
   && curl -fsSL -o "gradle-${GRADLE_VERSION}-bin.zip" "${BASE_URL}/gradle-${GRADLE_VERSION}-bin.zip" \
   && echo "${SHA}  gradle-${GRADLE_VERSION}-bin.zip" | sha256sum -c - \

javac/Dockerfile

@@ -16,7 +16,7 @@ RUN \
 # Install Docker based on instructions from:
 # https://docs.docker.com/engine/installation/linux/docker-ce/debian
 RUN \
-   apt-get -y update && \
+   apt-get update -qqy && apt-get dist-upgrade -yq && \
    apt-get --fix-broken -y install && \
    apt-get -y install apt-transport-https ca-certificates curl gnupg2 software-properties-common && \
    curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add - && \

mvn/Dockerfile

@@ -1,3 +1,13 @@
 ARG MAVEN_VERSION=latest
 FROM maven:${MAVEN_VERSION}
+# Upstream maven images for JDK >= 16 are Oracle Linux (ol) based
+# and others are based on Debian base image
+RUN v=$(awk </etc/os-release -F = '$1 ~ /VERSION_ID/ {gsub(/"/,"",$2);print set $2}') && \
+    dist=$(awk </etc/os-release -F = '$1 ~ /^ID_LIKE/ {gsub(/"/,"",$2);print set $2}') && \
+    if [ "$dist" = "debian" ] && [ "$v" -gt 9 ] ;  \
+    then apt-get update -qqy && apt-get dist-upgrade -yq ; \
+    elif  [ "$dist" = "fedora" ] ; \
+    then microdnf clean all && microdnf update --refresh --nodocs && microdnf clean all ; \
+    fi
+
 ENTRYPOINT ["mvn"]

twine/Dockerfile

@@ -1,4 +1,5 @@
 FROM python:3.10.7-slim-bullseye
+RUN apt-get update -qqy && apt-get dist-upgrade -yq 
 RUN /bin/sh -c set -eux; pip install twine==4.0.1
 RUN /bin/sh -c set -eux; pip install keyrings.google-artifactregistry-auth==1.1.1
 ENTRYPOINT ["python3", "-m", "twine"]

wget/Dockerfile

@@ -1,7 +1,7 @@
 FROM gcr.io/gcp-runtimes/ubuntu_20_0_4
 
-RUN apt-get update && \
-  apt-get -y install wget ca-certificates
+RUN apt-get update -qqy && apt-get dist-upgrade -yq && \
+    apt-get -y install wget ca-certificates
 
 COPY notice.sh /usr/bin
 ENTRYPOINT ["/usr/bin/notice.sh"]