docs/tickets
20
4
Issues 32 Pull requests Projects Activity

Outdated docsbuilder.sh pulls Antora container w/ EOL nodejs #19

New issue
Open
opened 2026-03-15 12:11:05 +00:00 by tk2345 · 16 comments
tk2345 commented 2026-03-15 12:11:05 +00:00
Copy link

Instances of docsbuilder.sh in various repos pull one of two container images, docker.io/antora/antora or registry.gitlab.com/fedora/docs/docs-website/docs-fp-o. Both images are outdated and contain numerous security issues.

The docker image uses alpine 3.18.3 from 2023-08-07 as base image and ships with nodejs 16.20.2 (EOL 2023-09-12).

The gitlab image uses fedora-minimal 42 from mid-2025 (exact date unknown) as base image and has been pushed to a registry not typically used by Fedora.

[Edited for clarity.]

Instances of docsbuilder.sh in various repos pull one of two container images, docker.io/antora/antora or registry.gitlab.com/fedora/docs/docs-website/docs-fp-o. Both images are outdated and contain numerous security issues. The docker image uses alpine 3.18.3 from 2023-08-07 as base image and ships with nodejs 16.20.2 (EOL 2023-09-12). The gitlab image uses fedora-minimal 42 from mid-2025 (exact date unknown) as base image and has been pushed to a registry not typically used by Fedora. [Edited for clarity.]
tk2345 commented 2026-03-18 16:47:31 +00:00
Author
Copy link

I didn't find the Containerfile for the gitlab image. podman history reports

CREATED BY
/bin/sh -c #(nop) ENTRYPOINT [ "antora" ]
/bin/sh -c #(nop) WORKDIR /antora
/bin/sh -c npm i -g @antora/cli@3.1 @antora/site-generator@3.1 @antora/lunr-extension@1.0.0-alpha.8 cheerio @asciidoctor/tabs
/bin/sh -c microdnf -y install --setopt=install_weak_deps=False     nodejs-npm &&     microdnf clean all
KIWI 10.2.24

[Edited]

I didn't find the Containerfile for the gitlab image. podman history reports ``` CREATED BY /bin/sh -c #(nop) ENTRYPOINT [ "antora" ] /bin/sh -c #(nop) WORKDIR /antora /bin/sh -c npm i -g @antora/cli@3.1 @antora/site-generator@3.1 @antora/lunr-extension@1.0.0-alpha.8 cheerio @asciidoctor/tabs /bin/sh -c microdnf -y install --setopt=install_weak_deps=False nodejs-npm && microdnf clean all KIWI 10.2.24 ``` [Edited]
jflory7 added this to the (deleted) project 2026-04-08 23:37:36 +00:00
jflory7 commented 2026-05-05 14:17:21 +00:00
Owner
Copy link

Discussed in 2026-05-05 Docs Team meeting.

The team briefly touched base on this ticket. It was confirmed that the primary script updates need to happen in the docs-template repository first before the changes are propagated via submodules to the other repositories.

Follow-up Items:

  • Action: @hricky to add a comment update on progress and next steps for updates to the Docs Template repo.
_Discussed in [2026-05-05 Docs Team meeting](https://discussion.fedoraproject.org/t/fedora-docs-team-meeting-2026-05-05-organization-wide-issue-labels-workflow-updates/190491)_. --- The team briefly touched base on this ticket. It was confirmed that the primary script updates need to happen in the `docs-template` repository first before the changes are propagated via submodules to the other repositories. **Follow-up Items:** * **Action:** @hricky to add a comment update on progress and next steps for updates to the Docs Template repo.
tk2345 commented 2026-05-06 05:14:24 +00:00
Author
Copy link

Attached the results of security scans with docker.io/anchore/grype.

[Edited]

Attached the results of security scans with docker.io/anchore/grype. [Edited]
gitlab.txt
16 KiB
docker.txt
17 KiB
hricky commented 2026-05-19 12:24:54 +00:00
Owner
Copy link

Thanks for reporting this. We've inspected the container image and found some context:

$ skopeo inspect --config docker://registry.gitlab.com/fedora/docs/docs-website/docs-fp-o:latest | jq --raw-output 'paths(scalars) as $p | "\($p | join(".")): \(getpath($p))"'

created: 2025-09-08T07:32:40.306152409Z
author: Fedora Project Contributors <devel@lists.fedoraproject.org>
architecture: amd64
os: linux
config.Env.0: PATH=/usr/local/bin:/usr/bin
config.Env.1: container=oci
config.Entrypoint.0: antora
config.WorkingDir: /antora
config.Labels.io.buildah.version: 1.41.3
config.Labels.license: MIT
config.Labels.name: fedora-minimal
config.Labels.org.opencontainers.image.license: MIT
config.Labels.org.opencontainers.image.name: fedora-minimal
config.Labels.org.opencontainers.image.url: https://fedoraproject.org/
config.Labels.org.opencontainers.image.vendor: Fedora Project
config.Labels.org.opencontainers.image.version: 42
config.Labels.vendor: Fedora Project
config.Labels.version: 42
rootfs.type: layers
rootfs.diff_ids.0: sha256:3fcb3d71e4d61771e41ba3477a4dc3ec76c691d62df1485f6066afb6aba06ea6
rootfs.diff_ids.1: sha256:57e476bdd34476dfe3d97eb677e2a3028729e7af831f99fa104d4b7bab4bd81c
rootfs.diff_ids.2: sha256:24797174a01895712662fb22d5f7260cd35974bfdb5c8e3befdc0fa8e72be980
history.0.created: 2025-06-27T06:49:04.209448073Z
history.0.created_by: KIWI 10.2.24
history.0.author: Fedora Project Contributors <devel@lists.fedoraproject.org>
history.1.created: 2025-09-08T07:32:07.29065309Z
history.1.created_by: /bin/sh -c microdnf -y install --setopt=install_weak_deps=False     nodejs-npm &&     microdnf clean all
history.1.author: Fedora Project Contributors <devel@lists.fedoraproject.org>
history.1.comment: FROM registry.fedoraproject.org/fedora-minimal:42
history.2.created: 2025-09-08T07:32:38.628786226Z
history.2.created_by: /bin/sh -c npm i -g @antora/cli@3.1 @antora/site-generator@3.1 @antora/lunr-extension@1.0.0-alpha.8 cheerio @asciidoctor/tabs
history.2.author: Fedora Project Contributors <devel@lists.fedoraproject.org>
history.3.created: 2025-09-08T07:32:40.216596244Z
history.3.created_by: /bin/sh -c #(nop) WORKDIR /antora
history.3.author: Fedora Project Contributors <devel@lists.fedoraproject.org>
history.3.empty_layer: true
history.4.created: 2025-09-08T07:32:40.306375404Z
history.4.created_by: /bin/sh -c #(nop) ENTRYPOINT [ "antora" ]
history.4.author: Fedora Project Contributors <devel@lists.fedoraproject.org>
history.4.empty_layer: true

The container image pulled by docsbuilder.sh is likely built from a similar Containerfile:

https://forge.fedoraproject.org/docs/docs-fp-o/src/branch/prod/build-scripts/Dockerfile

It appears the above Containerfile is used in OpenShift to rebuild the whole site for Fedora.

We will continue to investigate the relevance of the image and the security status to address the concerns you raised.

Thanks for reporting this. We've inspected the container image and found some context: ``` $ skopeo inspect --config docker://registry.gitlab.com/fedora/docs/docs-website/docs-fp-o:latest | jq --raw-output 'paths(scalars) as $p | "\($p | join(".")): \(getpath($p))"' created: 2025-09-08T07:32:40.306152409Z author: Fedora Project Contributors <devel@lists.fedoraproject.org> architecture: amd64 os: linux config.Env.0: PATH=/usr/local/bin:/usr/bin config.Env.1: container=oci config.Entrypoint.0: antora config.WorkingDir: /antora config.Labels.io.buildah.version: 1.41.3 config.Labels.license: MIT config.Labels.name: fedora-minimal config.Labels.org.opencontainers.image.license: MIT config.Labels.org.opencontainers.image.name: fedora-minimal config.Labels.org.opencontainers.image.url: https://fedoraproject.org/ config.Labels.org.opencontainers.image.vendor: Fedora Project config.Labels.org.opencontainers.image.version: 42 config.Labels.vendor: Fedora Project config.Labels.version: 42 rootfs.type: layers rootfs.diff_ids.0: sha256:3fcb3d71e4d61771e41ba3477a4dc3ec76c691d62df1485f6066afb6aba06ea6 rootfs.diff_ids.1: sha256:57e476bdd34476dfe3d97eb677e2a3028729e7af831f99fa104d4b7bab4bd81c rootfs.diff_ids.2: sha256:24797174a01895712662fb22d5f7260cd35974bfdb5c8e3befdc0fa8e72be980 history.0.created: 2025-06-27T06:49:04.209448073Z history.0.created_by: KIWI 10.2.24 history.0.author: Fedora Project Contributors <devel@lists.fedoraproject.org> history.1.created: 2025-09-08T07:32:07.29065309Z history.1.created_by: /bin/sh -c microdnf -y install --setopt=install_weak_deps=False nodejs-npm && microdnf clean all history.1.author: Fedora Project Contributors <devel@lists.fedoraproject.org> history.1.comment: FROM registry.fedoraproject.org/fedora-minimal:42 history.2.created: 2025-09-08T07:32:38.628786226Z history.2.created_by: /bin/sh -c npm i -g @antora/cli@3.1 @antora/site-generator@3.1 @antora/lunr-extension@1.0.0-alpha.8 cheerio @asciidoctor/tabs history.2.author: Fedora Project Contributors <devel@lists.fedoraproject.org> history.3.created: 2025-09-08T07:32:40.216596244Z history.3.created_by: /bin/sh -c #(nop) WORKDIR /antora history.3.author: Fedora Project Contributors <devel@lists.fedoraproject.org> history.3.empty_layer: true history.4.created: 2025-09-08T07:32:40.306375404Z history.4.created_by: /bin/sh -c #(nop) ENTRYPOINT [ "antora" ] history.4.author: Fedora Project Contributors <devel@lists.fedoraproject.org> history.4.empty_layer: true ``` The container image pulled by `docsbuilder.sh` is likely built from a similar Containerfile: https://forge.fedoraproject.org/docs/docs-fp-o/src/branch/prod/build-scripts/Dockerfile It appears the above Containerfile is used in OpenShift to rebuild the whole site for Fedora. We will continue to investigate the relevance of the image and the security status to address the concerns you raised.
hricky commented 2026-05-19 12:40:00 +00:00
Owner
Copy link

Actually, the container image pulled by docsbuilder.sh is likely built from this Containerfile:

https://forge.fedoraproject.org/docs/docs-fp-o/src/branch/prod/Dockerfile

Actually, the container image pulled by `docsbuilder.sh` is likely built from this Containerfile: https://forge.fedoraproject.org/docs/docs-fp-o/src/branch/prod/Dockerfile
hricky commented 2026-06-02 17:54:10 +00:00
Owner
Copy link

We discussed the issue in the community meeting. We will update the container image that the script pulls in the short term. We will create a dedicated repository for the script and a new container build process in the long term.

We discussed the issue in the [community meeting](https://meetbot.fedoraproject.org/meeting_matrix_fedoraproject-org/2026-06-02/fedora-docs-team-meeting-2026-06-02.2026-06-02-13.00.log.html). We will update the container image that the script pulls in the short term. We will create a dedicated repository for the script and a new container build process in the long term.
👍 1
hricky commented 2026-06-05 17:30:32 +00:00
Owner
Copy link

Context on the current situation:

AIUI, the GitLab CI (.gitlab-ci.yml) was previously building and pushing the container image to the GitLab registry. Specifically, it would:

  • Build the image from the Dockerfile in the prod branch
  • Push it to registry.gitlab.com/fedora/docs/docs-website/docs-fp-o:latest
  • Only trigger on pushes to the prod branch when the Dockerfile or .gitlab-ci.yml changed

The docsbuilder.sh script pulls this image and builds the preview.

Current blocker:

Following the migration to Fedora Forge, we no longer have a functional CI in place to automatically build and push updated images. We will likely need a runner for the Fedora Forge Docs org for this.

Temporary solutions:

  1. Manual build and push: Build the image locally with an updated Dockerfile and push it to a dedicated repo in quay.io. We will likely need this repo in the long term anyway. This is the quickest path forward but requires manual intervention each time the image needs updating.

  2. Add local build option to the script: Modify the script to support an option that builds the container image locally before running the docs module preview. This makes the workflow self-contained, though we will need to provide a Containerfile or document how to create one.

The first approach would unblock the immediate issue while we work on the permanent CI solution. The second can be implemented in the longer term.

Context on the current situation: AIUI, the GitLab CI ([`.gitlab-ci.yml`](https://forge.fedoraproject.org/docs/docs-fp-o/src/branch/prod/.gitlab-ci.yml)) was previously building and pushing the container image to the GitLab registry. Specifically, it would: - Build the image from the [`Dockerfile`](https://forge.fedoraproject.org/docs/docs-fp-o/src/branch/prod/Dockerfile) in the `prod` branch - Push it to `registry.gitlab.com/fedora/docs/docs-website/docs-fp-o:latest` - Only trigger on pushes to the `prod` branch when the `Dockerfile` or `.gitlab-ci.yml` changed The `docsbuilder.sh` script pulls this image and builds the preview. Current blocker: Following the migration to Fedora Forge, we no longer have a functional CI in place to automatically build and push updated images. We will likely need a runner for the Fedora Forge Docs org for this. Temporary solutions: 1. Manual build and push: Build the image locally with an updated `Dockerfile` and push it to a dedicated repo in `quay.io`. We will likely need this repo in the long term anyway. This is the quickest path forward but requires manual intervention each time the image needs updating. 2. Add local build option to the script: Modify the script to support an option that builds the container image locally before running the docs module preview. This makes the workflow self-contained, though we will need to provide a Containerfile or document how to create one. The first approach would unblock the immediate issue while we work on the permanent CI solution. The second can be implemented in the longer term.
pbokoc commented 2026-06-06 19:06:40 +00:00
Owner
Copy link

@hricky wrote in #19 (comment):

We will likely need a runner for the Fedora Forge Docs org for this.

We do have one. Can you see this link? I'm not sure if it's accessible to just owners or if it's visible to team members as well. https://forge.fedoraproject.org/org/docs/settings/actions/runners/61

@hricky wrote in https://forge.fedoraproject.org/docs/tickets/issues/19#issuecomment-818044: > We will likely need a runner for the Fedora Forge Docs org for this. We do have one. Can you see this link? I'm not sure if it's accessible to just owners or if it's visible to team members as well. https://forge.fedoraproject.org/org/docs/settings/actions/runners/61
hricky commented 2026-06-06 19:32:21 +00:00
Owner
Copy link

In my experience, by default only org owners can see and change Action settings. I don't need to do this to use the runner. Do we have a repo in the Docs org that currently uses this runner? If not, I'll need the runner's label and your permission to open PRs to test it.

In my experience, by default only org owners can see and change Action settings. I don't need to do this to use the runner. Do we have a repo in the Docs org that currently uses this runner? If not, I'll need the runner's label and your permission to open PRs to test it.
hricky commented 2026-06-24 11:05:54 +00:00
Owner
Copy link

We can't build container images with the default runner we currently have in our organization.

In the long term, we should use Konflux, but for now we will request a testing-farm runner on the Fedora Forge staging instance to test whether we can use it to build container images. If it works, we will request a testing-farm runner for Docs organizations in both the staging and production instances.

We can't build container images with the default runner we currently have in our organization. In the long term, we should use Konflux, but for now we will request a `testing-farm` runner on the Fedora Forge staging instance to test whether we can use it to build container images. If it works, we will request a `testing-farm` runner for Docs organizations in both the staging and production instances.
jflory7 commented 2026-06-29 22:34:18 +00:00
Owner
Copy link

Moving this issue from the 2026 Q2 Team Goals milestone to 2026 Q3 Team Goals. The Q2 milestone is closing out at the end of June. Good progress was made this quarter on investigating the container image situation and identifying a path forward with the testing-farm runner.

This issue is connected to the wider topic of CI in Fedora Docs, which we will discuss in ticket #49 at tomorrow's Fedora Docs Team meeting.

Assisted-by: Claude Opus 4.6 (1M context)

Moving this issue from the **2026 Q2 Team Goals** milestone to **2026 Q3 Team Goals**. The Q2 milestone is closing out at the end of June. Good progress was made this quarter on investigating the container image situation and identifying a path forward with the testing-farm runner. This issue is connected to the wider topic of CI in Fedora Docs, which we will discuss in ticket #49 at tomorrow's Fedora Docs Team meeting. <sub>_Assisted-by: Claude Opus 4.6 (1M context)_</sub>
jflory7 commented 2026-06-30 17:32:29 +00:00
Owner
Copy link

Discussed in 2026-06-30 Fedora Docs Team meeting.

@hricky reported progress on the docsbuilder.sh refactor discussed at Flock. He has a draft Python script and will open a PR in the staging playground repo for tracking and discussion. Building the Antora container image in a Forgejo pipeline remains complex. Short-term plan: local image building with documentation on how to use the script. The Fedora Forge Team uses Konflux and Quay.io for container builds — the Docs Team should plan in that direction.

  • ACTION: @hricky: Write a proposal for how to best solve the docsbuilder.sh refactor work, triage ticket #19 as meeting topic when ready to share the proposal and discuss with the team
  • Consider Quay.io as a practical alternative to Forgejo container registries in the short term
  • This will be a large-scale change — testing help will be needed when @hricky's work is ready
  • Remove meeting topic label until the proposal is ready for team discussion

Assisted-by: Claude Opus 4.6 (1M context)

_Discussed in [2026-06-30 Fedora Docs Team meeting](https://discussion.fedoraproject.org/t/fedora-docs-team-meeting-2026-06-30/195195/3)._ --- @hricky reported progress on the `docsbuilder.sh` refactor discussed at Flock. He has a draft Python script and will open a PR in the [staging playground repo](https://forge.stg.fedoraproject.org/playground/docs-fp-o-ci-test) for tracking and discussion. Building the Antora container image in a Forgejo pipeline remains complex. Short-term plan: local image building with documentation on how to use the script. The Fedora Forge Team uses Konflux and Quay.io for container builds — the Docs Team should plan in that direction. - **ACTION:** @hricky: Write a proposal for how to best solve the `docsbuilder.sh` refactor work, triage ticket #19 as `meeting topic` when ready to share the proposal and discuss with the team - Consider Quay.io as a practical alternative to Forgejo container registries in the short term - This will be a large-scale change — testing help will be needed when @hricky's work is ready - Remove `meeting topic` label until the proposal is ready for team discussion <sub>_Assisted-by: Claude Opus 4.6 (1M context)_</sub>
jflory7 commented 2026-07-14 14:29:47 +00:00
Owner
Copy link

Discussed in 2026-07-14 Fedora Docs Team meeting.

@hricky reported progress on the docsbuilder.sh refactor. A PR is now open at docs/docs-fp-o#46 demonstrating that the container image can be built. He will continue updating this issue with the formal proposal and is doing ongoing work in the staging environment at https://forge.stg.fedoraproject.org/playground/docs-fp-o-ci-test.

Follow-up:

  • @hricky: Will update this issue with the formal proposal
  • @hricky: Continuing work in the staging environment
  • Everyone: Review the PR at docs/docs-fp-o#46

Assisted-by: Claude Opus 4.6 (1M context)

_Discussed in [2026-07-14 Fedora Docs Team meeting](https://discussion.fedoraproject.org/t/fedora-docs-team-meeting-2026-07-14/196628)._ --- @hricky reported progress on the `docsbuilder.sh` refactor. A PR is now open at [docs/docs-fp-o#46](https://forge.fedoraproject.org/docs/docs-fp-o/pulls/46) demonstrating that the container image can be built. He will continue updating this issue with the formal proposal and is doing ongoing work in the staging environment at https://forge.stg.fedoraproject.org/playground/docs-fp-o-ci-test. **Follow-up:** - @hricky: Will update this issue with the formal proposal - @hricky: Continuing work in the staging environment - Everyone: Review the PR at [docs/docs-fp-o#46](https://forge.fedoraproject.org/docs/docs-fp-o/pulls/46) <sub>_Assisted-by: Claude Opus 4.6 (1M context)_</sub>
tk2345 commented 2026-07-14 20:38:28 +00:00
Author
Copy link

Everyone: Review the PR at docs/docs-fp-o#46

The runner uses quay.io/containers/aio:latest from 2026-05-27. aio used to get updated every week, not anymore. https://quay.io/repository/containers/aio?tab=tags&tag=latest

Attached the result of a security scan with docker.io/anchore/grype.

> Everyone: Review the PR at docs/docs-fp-o#46 The runner uses quay.io/containers/aio:latest from 2026-05-27. aio used to get updated every week, not anymore. [https://quay.io/repository/containers/aio?tab=tags&tag=latest](https://quay.io/repository/containers/aio?tab=tags&tag=latest) Attached the result of a security scan with docker.io/anchore/grype.
aio.txt
28 KiB
hricky commented 2026-07-14 21:22:22 +00:00
Owner
Copy link

@tk2345 wrote in #19 (comment):

Attached the result of a security scan with docker.io/anchore/grype.

If the goal is to build a container image with the fewest possible vulnerabilities reported by the grype scanner, we could achieve that.

@tk2345 wrote in https://forge.fedoraproject.org/docs/tickets/issues/19#issuecomment-1062561: > Attached the result of a security scan with docker.io/anchore/grype. If the goal is to build a container image with the fewest possible vulnerabilities reported by the `grype` scanner, we could achieve that.
tk2345 commented 2026-07-16 09:08:11 +00:00
Author
Copy link

deleted

deleted
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
Contributors' Guidance
Improve written Material
 Improve the existing contributor documentation

  
Contributors' Guidance
technical support measures
 Improve contributors' guidance by technical efforts like vale or similiar linters

  
effort
high
 Will take a long time

  
effort
low
 Easy fix

  
effort
medium
 Will take some time

  
good first issue
Take this if you're new!

  
help wanted
Needs help or feedback from the wider Fedora community

  
meeting topic
Need to discuss this at a Docs team meeting

  
needs changes
Needs changes or fixes before closing

  
needs reporter feedback
Additional feedback or information from the reporter is needed to advance

  
needs review
Someone needs to look at this

  
priority
high
 Fix this NOW NOW NOW!

  
priority
low
 Low priority tasks

  
priority
medium
 Medium priority tasks

  
priority
on hold
 Work has been temporarily halted, usually because another task needs to be completed first.

  
type/content
Changes to the contents of the site - the actual docs

  
type/misc
Changes to non-content parts of the site. CSS, Actions, scripts, etc.

No labels
Contributors' Guidance
Improve written Material
Contributors' Guidance
technical support measures
effort
high
effort
low
effort
medium
good first issue
help wanted
meeting topic
needs changes
needs reporter feedback
needs review
priority
high
priority
low
priority
medium
priority
on hold
type/content
type/misc
Milestone
Clear milestone
No items
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
hricky
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
docs/tickets#19
No description provided.