Bryan, What version of kernel-headers are you seeing in the image. I think this might be some kind of mistake with the scanning. I have a vague recollection that some scanners mess up kernel headers. The kernel headers is just code, so it can't really have vulnerabilities. If I understand the problem correctly: 1. You don't really have a security vulnerability problem 2.The scanner might be giving you a false positive 3. And/Or, the kernel-headers really might not be getting updated

> Hi all > > Not sure this is the best place to ask or not, scenario is as follows: - > > building container with podman locally to check it does build - trying it > in quay.io and I'm bumping up against a vulnerability I can't seem to > correct which I'm thinking is something I'm doing. > > I'm uploading a Dockerfile (for want of a better file name) to start the > build, but it always finds a vulnerability in kernel-headers for ubi7 which > I can't seem to get to update from the build despite yum -y update - it's > the gcc package that it loads up. > > Dockerfile looks like this: - > > FROM registry.access.redhat.com/ubi7/ubi > RUN yum -y update && yum -y install > https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm > && yum -y update && yum -y install python2 && yum -y install make && yum -y > install gcc && yum -y install redhat-rpm-config && yum -y install > zlib-devel && yum -y install bzip2 && yum -y install xz-devel && yum -y > install python2-devel && yum -y install git && yum -y install python2-pip > && yum -y install wget && yum -y install sudo && yum -y install bash && yum > clean all > CMD ["/bin/bash"] > USER 0 > RUN curl -o miniconda.sh > https://repo.continuum.io/miniconda/Miniconda2-latest-Linux-x86_64.sh > RUN bash miniconda.sh -b -p /opt/miniconda > RUN ln -s /opt/miniconda/bin/python /usr/local/bin/python > RUN ln -s /opt/miniconda/bin/pip /usr/local/bin/pip > RUN ln -s /opt/miniconda/bin/conda /usr/local/bin/conda > RUN conda config --add channels defaults > RUN conda config --add channels bioconda > RUN conda config --add channels conda-forge > RUN conda init bash > RUN echo y | conda create -n clairvoyante-conda-env -c bioconda > clairvoyante > > The quay.io creation is here: - > > https://quay.io/repository/bryanhepworth/clairvoyante?tab=tags > > Any help most gratefully received. > > Bryan > _______________________________________________ > Podman mailing list -- podman(a)lists.podman.io > To unsubscribe send an email to podman-leave(a)lists.podman.io > -- -- Scott McCarty, RHCA Product Management - Containers, Red Hat Enterprise Linux & OpenShift Email: smccarty(a)redhat.com Phone: 312-660-3535 Cell: 330-807-1043 Web: http://crunchtools.com Have questions on Red Hat UBI? Check out the official FAQ: https://red.ht/2yaUcez _______________________________________________ Podman mailing list -- podman(a)lists.podman.io To unsubscribe send an email to podman-leave(a)lists.podman.io