Skip to content

Commit 741a209

Browse files
chaudumgrafana-delivery-bot[bot]
authored andcommitted
chore!: Remove wget from Promtail docker image (#15101)
The package has been added to the Docker image with PR #11711 with the intention to support the Docker healthcheck. However, to reduce the attack surface of our Docker images, we want to keep them as slim as possible. The current version of Promtail (3.3.0) for example contains a wget version with vulnerability [CVE-2024-38428](https://security-tracker.debian.org/tracker/CVE-2024-38428). The healthcheck can be achieved by other means, e.g. 1. Extend the `grafana/promtail` base image and add `wget` using `apt install wget` #11590 (comment) 3. Use low-level `/dev/tcp/127.0.0.1:9080` to establish a connection and check the exit code #11590 (comment) Original discussion about adding wget #11590 This may break someone's Docker compose installation, when they require on the `wget` powered health check. Signed-off-by: Christian Haudum <[email protected]> (cherry picked from commit 2eea546)
1 parent c4cb1a8 commit 741a209

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

clients/cmd/promtail/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ RUN make clean && make BUILD_IN_CONTAINER=false PROMTAIL_JOURNAL_ENABLED=true pr
1010
FROM debian:12.5-slim
1111
# tzdata required for the timestamp stage to work
1212
RUN apt-get update && \
13-
apt-get install -qy tzdata ca-certificates wget libsystemd-dev && \
13+
apt-get install -qy tzdata ca-certificates libsystemd-dev && \
1414
rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
1515
COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail
1616
COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml

0 commit comments

Comments
 (0)