From c86d936d5833e97b6e6daccb3d1e7beec3e3b2c1 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Sat, 19 Sep 2026 08:50:57 +0000 Subject: [PATCH 1/2] Require patched PCRE2 and glibc runtime packages --- BCI.dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/BCI.dockerfile b/BCI.dockerfile index 86a2a495..e50a393e 100644 --- a/BCI.dockerfile +++ b/BCI.dockerfile @@ -25,7 +25,8 @@ ENV DOCKER_STS_AGENT=true \ RUN zypper -n --gpg-auto-import-keys --installroot /chroot refresh && \ zypper -n --gpg-auto-import-keys --installroot /chroot update && \ zypper -n --installroot /chroot install util-linux libudev1 ca-certificates curl wget xz iproute2 conntrack-tools \ - 'libacl1>=2.4.0-150000.4.6.1' 'libattr1>=2.6.0-150000.4.3.1' && \ + 'libacl1>=2.4.0-150000.4.6.1' 'libattr1>=2.6.0-150000.4.3.1' \ + 'libpcre2-8-0>=10.42-150600.3.3.1' 'glibc>=2.38-150600.14.58.1' && \ zypper -n --root /chroot clean --all RUN mkdir -p /chroot/opt/stackstate-agent/bin/agent \ From a0a3d2fb0a224fcf0e93de1aec3295fde7913e3a Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Fri, 2 Oct 2026 09:48:28 +0000 Subject: [PATCH 2/2] Fix Trivy containerd and GLib findings in BCI runtime --- BCI.dockerfile | 5 ++++- go.mod | 2 +- go.sum | 2 ++ 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/BCI.dockerfile b/BCI.dockerfile index e50a393e..994f8b97 100644 --- a/BCI.dockerfile +++ b/BCI.dockerfile @@ -26,7 +26,10 @@ RUN zypper -n --gpg-auto-import-keys --installroot /chroot refresh && \ zypper -n --gpg-auto-import-keys --installroot /chroot update && \ zypper -n --installroot /chroot install util-linux libudev1 ca-certificates curl wget xz iproute2 conntrack-tools \ 'libacl1>=2.4.0-150000.4.6.1' 'libattr1>=2.6.0-150000.4.3.1' \ - 'libpcre2-8-0>=10.42-150600.3.3.1' 'glibc>=2.38-150600.14.58.1' && \ + 'libpcre2-8-0>=10.42-150600.3.3.1' 'glibc>=2.38-150600.14.58.1' \ + 'glib2-tools>=2.78.6-150600.4.41.1' 'libgio-2_0-0>=2.78.6-150600.4.41.1' \ + 'libglib-2_0-0>=2.78.6-150600.4.41.1' 'libgmodule-2_0-0>=2.78.6-150600.4.41.1' \ + 'libgobject-2_0-0>=2.78.6-150600.4.41.1' && \ zypper -n --root /chroot clean --all RUN mkdir -p /chroot/opt/stackstate-agent/bin/agent \ diff --git a/go.mod b/go.mod index 79e0f7dd..bfa71d2b 100644 --- a/go.mod +++ b/go.mod @@ -67,7 +67,7 @@ require ( github.com/Microsoft/hcsshim v0.12.9 // indirect github.com/awalterschulze/gographviz v2.0.3+incompatible // indirect github.com/beorn7/perks v1.0.1 // indirect - github.com/containerd/containerd v1.7.35 // indirect + github.com/containerd/containerd v1.7.36 // indirect github.com/containerd/continuity v0.4.4 // indirect github.com/containerd/fifo v1.1.0 // indirect github.com/containerd/ttrpc v1.2.7 // indirect diff --git a/go.sum b/go.sum index 73cd9acf..d0d39355 100644 --- a/go.sum +++ b/go.sum @@ -574,6 +574,8 @@ github.com/containerd/containerd v1.7.33 h1:iAkYGC/ifR/V+0eR4iXWHNGYUF0DF2PmGV5i github.com/containerd/containerd v1.7.33/go.mod h1:gSbSCVjPCdkfJCjyrzz7aRC+xFlqVbatNpfHfVCYGUM= github.com/containerd/containerd v1.7.35 h1:7AU2T1qI2OdNBmKkreWZ7kASHUNFItN5Hgejd9sY938= github.com/containerd/containerd v1.7.35/go.mod h1:ozI//0TomTCLPhQREnx0IXDIQMg+Fk7yTtg9fNvU8EQ= +github.com/containerd/containerd v1.7.36 h1:HyMsOG5kmp1LQsGzqwI6Ts06T4VpYZbszfDZYB0bW5w= +github.com/containerd/containerd v1.7.36/go.mod h1:ozI//0TomTCLPhQREnx0IXDIQMg+Fk7yTtg9fNvU8EQ= github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0= github.com/containerd/containerd/api v1.8.0/go.mod h1:dFv4lt6S20wTu/hMcP4350RL87qPWLVa/OHOwmmdnYc= github.com/containerd/continuity v0.4.4 h1:/fNVfTJ7wIl/YPMHjf+5H32uFhl63JucB34PlCpMKII=