starred/appstore
1
0
Fork 0
mirror of https://github.com/okxlin/appstore.git synced 2026-09-22 16:00:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Unpin microbin latest images and update docs

Browse Source
This commit is contained in:
okxlin
2026-07-31 09:50:02 +08:00
parent 9457ae896d
commit 6c3eae7fe4
2 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/microbin/README.md
+6 -6
View File
@@ -21,8 +21,8 @@ MicroBin 是使用 Rust 编写的轻量自托管分享服务，可发布文本
## 安全与部署风险
- 官方镜像默认以 root 运行；本应用强制使用 `65534:65534`，并已验证文本、附件、重启和持久化流程。容器使用只读根文件系统、丢弃全部 Linux capabilities，并启用 `no-new-privileges`。
- 当前官方镜像的新鲜双架构扫描包含基础系统漏洞。MicroBin 二进制只动态链接 libc、libm 和 libgcc，不链接系统 OpenSSL，也不调用镜像中的 Perl、Archive::Tar、Storable、gzip、mount、libcap 或 ncurses 工具。32 位 OpenSSL Critical 不适用于支持的 amd64/arm64 架构。
- 这些结论只覆盖官方入口和默认配置，并不表示镜像中没有漏洞。镜像摘要、入口或运行用户发生变化后必须重新扫描。
- 本次审计的官方镜像快照在双架构扫描中包含基础系统漏洞。MicroBin 二进制只动态链接 libc、libm 和 libgcc，不链接系统 OpenSSL，也不调用镜像中的 Perl、Archive::Tar、Storable、gzip、mount、libcap 或 ncurses 工具。32 位 OpenSSL Critical 不适用于支持的 amd64/arm64 架构。
- 这些结论只覆盖审计时的镜像快照、官方入口和默认配置，并不表示后续镜像中没有漏洞。移动 `latest` 标签解析到新镜像，或入口、运行用户发生变化后必须重新扫描。
## Introduction
@@ -42,11 +42,11 @@ MicroBin is a lightweight self-hosted sharing service written in Rust. It publis
## Security Note
Fresh scans of the official images contain base-system vulnerabilities. The MicroBin binary dynamically links only libc, libm, and libgcc; it neither links system OpenSSL nor invokes the image's Perl, Archive::Tar, Storable, gzip, mount, libcap, or ncurses tooling. The 32-bit-only OpenSSL Critical does not apply to the supported amd64/arm64 images. These are default-entrypoint reachability exceptions, not claims that the image is vulnerability-free. Any digest, entrypoint, or runtime-user change requires a fresh review.
Fresh scans of the audited official image snapshot contain base-system vulnerabilities. The MicroBin binary dynamically links only libc, libm, and libgcc; it neither links system OpenSSL nor invokes the image's Perl, Archive::Tar, Storable, gzip, mount, libcap, or ncurses tooling. The 32-bit-only OpenSSL Critical does not apply to the supported amd64/arm64 images. These are default-entrypoint reachability exceptions, not claims that later images are vulnerability-free. A new image resolved from the moving `latest` tag, or any entrypoint or runtime-user change, requires a fresh review.
## References
- Project: <https://github.com/szabodanika/microbin>
- Stable release: <https://github.com/szabodanika/microbin/releases/tag/v2.1.0>
- Official Compose: <https://github.com/szabodanika/microbin/blob/v2.1.0/compose.yaml>
- License: <https://github.com/szabodanika/microbin/blob/v2.1.0/LICENSE> (BSD-3-Clause)
- Stable release: <https://github.com/szabodanika/microbin/releases/tag/v2.1.4>
- Official Compose: <https://github.com/szabodanika/microbin/blob/v2.1.4/compose.yaml>
- License: <https://github.com/szabodanika/microbin/blob/v2.1.4/LICENSE> (BSD-3-Clause)
apps/microbin/latest/docker-compose.yml
+1 -1
View File
@@ -1,6 +1,6 @@
services:
microbin:
image: danielszabo99/microbin:latest@sha256:6660e5ccad0d764fa3c0032464ffb8f4b4f28c92a2eb9e39202b94cdc5b68909
image: danielszabo99/microbin:latest
container_name: ${CONTAINER_NAME}
restart: unless-stopped
user: "65534:65534"