Manajemen patch & update image terjadwal (pin by digest + scan) #9

New issue

Open

opened 2026-10-11 06:57:53 +00:00 by reza · 0 comments

reza commented

2026-10-11 06:57:53 +00:00

Owner

Kondisi sekarang: image pakai tag mengambang (forgejo:16, caddy:2, stalwartlabs/cli:latest), tanpa scan kerentanan atau auto-update.

Usulan:

Pin image ke digest; update terjadwal dengan Renovate/podman auto-update.
Scan dengan Trivy/Grype (di CI).
OS: unattended-upgrades + maintenance window.

Selesai bila:

Image di-pin digest
Scan kerentanan berkala
Prosedur update & rollback

**Kondisi sekarang:** image pakai tag mengambang (`forgejo:16`, `caddy:2`, `stalwartlabs/cli:latest`), tanpa scan kerentanan atau auto-update. **Usulan:** - Pin image ke **digest**; update terjadwal dengan Renovate/`podman auto-update`. - Scan dengan Trivy/Grype (di CI). - OS: `unattended-upgrades` + maintenance window. **Selesai bila:** - [ ] Image di-pin digest - [ ] Scan kerentanan berkala - [ ] Prosedur update & rollback

reza added the

area/security

priority/p1

labels

2026-10-11 06:57:53 +00:00