mirror of
https://github.com/jellyfin/jellyfin.git
synced 2026-03-01 11:20:59 +03:00
Docker images should rebuild periodically to pull in OS security updates #962
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @nevado on GitHub (Oct 7, 2019).
Describe the bug
Docker stable images are only built once at release time, and there can be several weeks / months between releases. In this time the underlying OS will receive security updates which won't get applied.
E.g. the 10.3.7 image has 40 outstanding security updates accumulated by the time of the 10.4.0 release.
To Reproduce
Expected behavior
Ideally the jellyfin:latest image would automatically rebuild the unchanged Jellyfin stable release onto the latest OS images periodically, say weekly or fortnightly, to pull in security fixes and build them into the latest docker image.
Logs
n/a
Screenshots
n/a
System (please complete the following information):
Additional context
n/a
@agilob commented on GitHub (Oct 7, 2019):
This will make docker images less reproducible and it assumes you make new docker-image releases not linked to new versions of the content delivered.
jellyfin:latestthis isn't goal oflatest, tag, I think you mean something more specific likelatest-stable-rebuild-from-alpineorlatest-stable-rebuild-from-stretch, people would start wondering why theirlatest-stable-rebuild-from-alpineis different from yourlatest-stable-rebuild-from-alpine, as not everyone pulls new version of same tag on a schedule.That's not really an issue for jellyfin to investigate, rather for baseimage repo.
I don't think delivery pipeline of jellyfin should care about bugs in glibc in debian/alpine. Time should be rather invested into not implementing bugs and vulnerabilities in jellyfin.
It would be also good to know what vulns these are, because unless they are remote-DoS on inside-docker level or RCE in ffmpeg, it's pretty much not even worth to build new image for some double-free error in a library that's just in the docker, but never used.
@joshuaboniface commented on GitHub (Oct 7, 2019):
This right here is frankly why I hate containers as a distribution mechanism. There is zero easy solution to this problem except to constantly rebuild the image over and over again. It might be possible to set up some sort of automated process to do so, but that adds a bunch of load and potential issues to the build infrastructure.
@nevado commented on GitHub (Oct 7, 2019):
No idea what the vulns are, that's the point, at some point there will be a vuln that does affect an internet facing Jellyfin setup so it would be best practice to just keep rebuilding the image periodically. It's crap but that's how docker works :-)
If anyone did want to look at this, I was thinking along the lines of the linuxserver.io dockers which rebuild periodically using a new tag, then :latest and :version get pointed at the latest stable up to date image of that version. See https://github.com/linuxserver/docker-jellyfin/tags. Users then pick up security updates when they update or they could use a specific build.
Agree lots of work and not high priority, just a wishlist item for future so feel free to close if it's not going to happen.
@agilob commented on GitHub (Oct 7, 2019):
Please close this issue than, it's not an issue or is lacking many details that would make this an issue ;)
Sure, that's just inevitable, not only for jellyfin scale, but for the whole internet.
Well... but yea, docker isn't designed to solve these problems. What you want is vagrant of VBOX, docker is intended for microservices, where a docker image weights 20Mb, not 550Mb, docker images are intended to scale horizontally, not for massive services like jellyfin, so of course if you use shovel to clean your head you're gonna hit yourself at some point.
Exactly! Why even bother duplicating the work if someone else already is committed to this?
I only used the latest jellyfin for a few minutes and already found a few bugs in webui, so maybe it would be better to commit this time to test, code review and fix old bugs? ;)
// no sarcasm indented.
@nevado commented on GitHub (Oct 7, 2019):
Not really looking to debate pros and cons of Docker here...
Facts are:
If you found other bugs, want to suggest a VBOX build, or you think no one should put effort into the official Jellyfin Docker build because there are other Jellyfin Docker builds out there, it might be more constructive to raise separate issues to discuss those.
@stale[bot] commented on GitHub (Feb 5, 2020):
This issue has gone 120 days without comment. To avoid abandoned issues, it will be closed in 21 days if there are no new comments.
If you're the original submitter of this issue, please comment confirming if this issue still affects you in the latest release or nightlies, or close the issue if it has been fixed. If you're another user also affected by this bug, please comment confirming so. Either action will remove the stale label.
This bot exists to prevent issues from becoming stale and forgotten. Jellyfin is always moving forward, and bugs are often fixed as side effects of other changes. We therefore ask that bug report authors remain vigilant about their issues to ensure they are closed if fixed, or re-confirmed - perhaps with fresh logs or reproduction examples - regularly. If you have any questions you can reach us on Matrix or Social Media.
@Xalaxis commented on GitHub (Feb 5, 2020):
I still think this is a valid issue. (Removing Stale)
@stale[bot] commented on GitHub (Jun 5, 2020):
This issue has gone 120 days without comment. To avoid abandoned issues, it will be closed in 21 days if there are no new comments.
If you're the original submitter of this issue, please comment confirming if this issue still affects you in the latest release or nightlies, or close the issue if it has been fixed. If you're another user also affected by this bug, please comment confirming so. Either action will remove the stale label.
This bot exists to prevent issues from becoming stale and forgotten. Jellyfin is always moving forward, and bugs are often fixed as side effects of other changes. We therefore ask that bug report authors remain vigilant about their issues to ensure they are closed if fixed, or re-confirmed - perhaps with fresh logs or reproduction examples - regularly. If you have any questions you can reach us on Matrix or Social Media.
@Xalaxis commented on GitHub (Jun 10, 2020):
Still a valid suggestion.
@stale[bot] commented on GitHub (Oct 9, 2020):
This issue has gone 120 days without comment. To avoid abandoned issues, it will be closed in 21 days if there are no new comments.
If you're the original submitter of this issue, please comment confirming if this issue still affects you in the latest release or nightlies, or close the issue if it has been fixed. If you're another user also affected by this bug, please comment confirming so. Either action will remove the stale label.
This bot exists to prevent issues from becoming stale and forgotten. Jellyfin is always moving forward, and bugs are often fixed as side effects of other changes. We therefore ask that bug report authors remain vigilant about their issues to ensure they are closed if fixed, or re-confirmed - perhaps with fresh logs or reproduction examples - regularly. If you have any questions you can reach us on Matrix or Social Media.
@Xalaxis commented on GitHub (Oct 9, 2020):
As far as I know this still isn't happening
On Fri, 9 Oct 2020, 14:02 stale[bot], notifications@github.com wrote:
@stale[bot] commented on GitHub (Feb 7, 2021):
This issue has gone 120 days without comment. To avoid abandoned issues, it will be closed in 21 days if there are no new comments.
If you're the original submitter of this issue, please comment confirming if this issue still affects you in the latest release or nightlies, or close the issue if it has been fixed. If you're another user also affected by this bug, please comment confirming so. Either action will remove the stale label.
This bot exists to prevent issues from becoming stale and forgotten. Jellyfin is always moving forward, and bugs are often fixed as side effects of other changes. We therefore ask that bug report authors remain vigilant about their issues to ensure they are closed if fixed, or re-confirmed - perhaps with fresh logs or reproduction examples - regularly. If you have any questions you can reach us on Matrix or Social Media.
@Xalaxis commented on GitHub (Feb 7, 2021):
In GitHub actions, this is as simple as adding a
scheduleparameter to the build configuration, so I think perhaps the complexity of doing this has been overstated.@stale[bot] commented on GitHub (Jun 9, 2021):
This issue has gone 120 days without comment. To avoid abandoned issues, it will be closed in 21 days if there are no new comments.
If you're the original submitter of this issue, please comment confirming if this issue still affects you in the latest release or nightlies, or close the issue if it has been fixed. If you're another user also affected by this bug, please comment confirming so. Either action will remove the stale label.
This bot exists to prevent issues from becoming stale and forgotten. Jellyfin is always moving forward, and bugs are often fixed as side effects of other changes. We therefore ask that bug report authors remain vigilant about their issues to ensure they are closed if fixed, or re-confirmed - perhaps with fresh logs or reproduction examples - regularly. If you have any questions you can reach us on Matrix or Social Media.
@Xalaxis commented on GitHub (Jun 18, 2021):
This is still a good idea.
@jellyfin-bot commented on GitHub (Oct 24, 2023):
This issue has gone 120 days without an update and will be closed within 21 days if there is no new activity. To prevent this issue from being closed, please confirm the issue has not already been fixed by providing updated examples or logs.
If you have any questions you can use one of several ways to contact us.
@jellyfin-bot commented on GitHub (Nov 14, 2023):
This issue was closed due to inactivity.