No image vulnerability scanning #108
Labels
No labels
audit-work
bug
docs
general-admin
major-upgrade
needs-vps-sync
new-service
on-hold
outside-work
post-podman
renovate
upstream
vps
No milestone
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
mysticalsoap/docker#108
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Digest pinning is a deliberate opt-out of silent security patches. That's the right call only if something tells you a pinned digest has since gone vulnerable, and Renovate reports "a newer version exists," not "yours is CVE'd."
Trivy or Grype on a weekly timer against the running set closes the loop this design opens.