Switch to hardened python images

[arteta22000]

Hello,

everything is in the title. Could it be a good idea to switch to these hardened python docker images or not? or just only core image (ui front) ?
=> https://hub.docker.com/hardened-images/catalog/dhi/python/images
=> https://hub.docker.com/hardened-images/catalog/dhi/valkey
=> https://hub.docker.com/hardened-images/catalog/dhi/mysql

[ostefano]

We use trixie underneath, so we are good.
Re valkey and mysql, as long as we are not allowed to push MISP image to docker hub, I would rather avoid that registry.

[arteta22000]

Hello,

Trixie is a Debian version? There is no native hardening (CIS, STIG)?

[ostefano]

Yes, trixie is debian13 (https://www.debian.org/releases/)

I am not doing any hardening at the moment.
Happy to merge improvements in that direction.

[arteta22000]

the change would essentially be:

FROM "${DOCKER_HUB_PROXY}python:3.12-slim-trixie" AS php-base

TO
FROM "${DOCKER_HUB_PROXY}dhi.io/python:3.12" AS php-base

https://hub.docker.com/hardened-images/catalog/dhi/python/images/python%2Fdebian%2F3.12/sha256-ba2cb4825534b68440637a068d1be761954a8b6639210238348b69371e39d94d

Do you see any potential problems?

[ostefano]

Does the python:3.12 image rely on Debian Trixie underneath?

[arteta22000]

Yes same

[ostefano]

Let's explore this. Opened a PR, feel free to test it.

[ostefano]

@arteta22000 the change is not trivial. Concerns:

1. Need to assess where to use -dev images
2. Lack of shell
3. Understand impact of TLS default certs for user-provided ones
4. Creation and maintenance of Docker creds for the CI/CD
5. Update of the docs

Feel free to spearhead this effort, I am assigning this issue to you.