Alpine images are 3 months old on docker hub

[AlenversFr]

Hello,

The docker images based on alpine seems to be outdated as they are built 3 month ago.
Is there any issue / limitation that blocks the publication of new build ?

We are used to benefit httpd images without any Critical or even High CVE in it. We have some concerns right now as httpd is a very popular image.

Regards

[tianon]

Unfortunately, the Alpine base images are not updated as proactively as we'd like them to be, and that's the primary means by which package updates get to dependent images in the Official Images program right now. One simple alternative would be to switch to the Debian-based image, which is proactively rebuilt to incorporate package updates.

You might find https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves useful as well.

Are there any package updates that actually affect the operation of httpd in a functional way? How severe are the vectors specifically in relation to httpd's operation? (The published and generic severity values rarely capture actual real-world usage / risk very well.)

[AlenversFr]

Hi @tianon,

Thanks for the update on this.

As a matter of fact, we apply a strict policy regarding CVE : 0 critical and 0 high
With httpd:2.4-alpine we've tested a simple package upgrade and it removes the CVE BUT we prefer to get fix from upstream as as soon as we touch the image we need to guaranty that it's working with all our internal client use cases (nightmare).

CVE localisations are located in apk add instructions :

when we scan the image 2.4-alpine :

Among the 7 High CVE in the image, when I look at available packages for alpine v3.21 we only miss latest version of libxml2 (2.13.6-r0). all other fixed version have been synced in March and April 2025.

At the time I wrote this issue all the packages had fixed version available.
If I understand correctly a simple rebuild of the image should have fix the issues.

I understand that the emergency level is not very high because of the severity of the CVEs but as end user we are used to benefit the extremely low number of CVE in httpd-alpine images.

Can you try to launch a rebuild for all Alpine distributions of httpd ?

[tianon]

As a matter of fact, we apply a strict policy regarding CVE : 0 critical and 0 high

That's an interesting choice you've made, but not one that we have.

We take security issues seriously, but that's not what CVEs (necessarily) are, so there's some unfortunate disparity that will be inherent in that disconnect. Again, see https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves for some longer-form explanation on that point.