Use busybox from alpine

Signed-off-by: Liam Newman <[email protected]>
prometheus · Oct 19, 2022 · 67a9d1a · 67a9d1a
1 parent 915c856
commit 67a9d1a
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/glibc/Dockerfile b/glibc/Dockerfile
@@ -29,7 +29,19 @@ RUN set -x \
         fi; \
     done
 
+FROM        ${ARCH}alpine:latest as alpine
+
 FROM        ${ARCH}busybox:glibc
 MAINTAINER  The Prometheus Authors <[email protected]>
 
+# Use the busybox executable from alpine which is generally patched more quickly for vulnerabilities
+COPY --from=alpine /bin/busybox /tmp/busybox
+COPY --from=alpine /lib/ld-musl* /lib/libc.musl* /lib/
+
+RUN cd /lib && \
+    ln -sf $(ls ld-musl*) $(ls libc.musl*) && \
+    rm /bin/* && \
+    /tmp/busybox --install /bin && \
+    mv /tmp/busybox /bin/
+
 COPY --from=0 /rootfs /
diff --git a/uclibc/Dockerfile b/uclibc/Dockerfile
@@ -28,7 +28,19 @@ RUN set -x \
         fi; \
     done
 
+FROM        ${ARCH}alpine:latest as alpine
+
 FROM        ${ARCH}busybox:uclibc
 MAINTAINER  The Prometheus Authors <[email protected]>
 
+# Use the busybox executable from alpine which is generally patched more quickly for vulnerabilities
+COPY --from=alpine /bin/busybox /tmp/busybox
+COPY --from=alpine /lib/ld-musl* /lib/libc.musl* /lib/
+
+RUN cd /lib && \
+    ln -sf $(ls ld-musl*) $(ls libc.musl*) && \
+    rm /bin/* && \
+    /tmp/busybox --install /bin && \
+    mv /tmp/busybox /bin/
+
 COPY --from=0 /rootfs /