[s373nZ]

Problem

The runtime stage pins alpine:3.20. That release reached end of life and no longer receives security advisories. Trivy says so directly during the scan:

WARN  This OS version is no longer supported by the distribution  family="alpine" version="3.20.10"
WARN  The vulnerability detection may be insufficient because security updates are not provided

The consequence is that the 0 OS-package finding count for this image is not evidence of a clean base — it is the absence of data. RUN apk update && apk upgrade also cannot pull fixes that the branch no longer publishes.

Change

Bump the runtime base to alpine:3.24, the current stable release (published 2026-06-09, supported until 2028-06-01 per alpinelinux.org/releases.json). One line; the builder stage is untouched.

Verification

Built the image with docker build --no-cache to match a clean CI runner, then ran the same scan as the workflow (Trivy 0.69.3, --ignore-unfixed --pkg-types os,library --severity CRITICAL,HIGH):

┌────────────────────────────────┬──────────┬─────────────────┬─────────┐
│             Target             │   Type   │ Vulnerabilities │ Secrets │
├────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ emulator (alpine 3.24.1)       │  alpine  │        0        │    -    │
├────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ app/emulator                   │ gobinary │        1        │    -    │
└────────────────────────────────┴──────────┴─────────────────┴─────────┘

Alpine findings are now a real zero, on a branch that still publishes advisories. apk upgrade correctly pulls libcrypto3/libssl3 3.5.8-r0, which carries the fix for CVE-2026-14456.

Worth noting for reviewers: an incremental (cached) build of this change can appear to introduce two HIGH openssl findings. That is a stale RUN apk update && apk upgrade layer being reused, not a regression from 3.24. CI builds without a cache, so it is not affected. Use --no-cache when reproducing locally.

Relationship to #154

This branch is cut from master, so it still carries google.golang.org/grpc v1.83.1 and the Trivy check here will fail on CVE-2026-84445 until #154 merges. That gRPC finding is the sole remaining item and is exactly what #154 fixes.

Suggested order: merge #154 first, then rebase this branch — the scan then reports zero across both targets.

Summary by CodeRabbit

• Chores
  • Updated the application’s runtime environment to use Alpine Linux 3.24.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: df46eca5-6779-425a-a81b-77040b819652

📥 Commits

Reviewing files that changed from the base of the PR and between 41b9954 and 8a21b4d.

📒 Files selected for processing (1)

• Dockerfile

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The Dockerfile runtime stage now uses alpine:3.24 instead of alpine:3.20. The builder stage and remaining runtime instructions are unchanged.

Changes

Runtime image update

Layer / File(s)	Summary
Update runtime base image Dockerfile	The final runtime stage now uses alpine:3.24.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 8a21b

The runtime image update is limited to the Alpine version bump, with no identified merge-blocking impact.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating the Docker runtime base image from Alpine 3.20 to Alpine 3.24.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/alpine-base-eol

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[arkana-ai-bot]

Arkana Review — #155

Scope: one-line runtime base bump, alpine:3.20 → alpine:3.24. No protocol-level code touched; no VTXO/signing/forfeit/round/exit impact. No cross-repo API surface affected.

---

Findings

[Rebase required — CI will fail] Dockerfile:29

The PR body correctly identifies that the Trivy scan will fail on the gRPC CVE-2026-84445 gobinary finding until #154 is merged and this branch is rebased. However, #154 is already merged into master (commit 41b9954). The branch just needs a rebase onto master before CI can go green. No code change needed — purely a rebase.

[Minor / pre-existing] Dockerfile:29 — no image digest pin

FROM alpine:3.24 resolves at pull time by tag. A mutable tag means a silent base swap is possible if the upstream tag is ever force-pushed. This pattern predates this PR and is consistent with the existing builder stage (FROM golang:1.26.6 AS builder). Recommend tracking a sha256 digest for reproducibility and supply-chain hygiene, but this is out of scope for this PR.

[Minor / pre-existing] Dockerfile — container runs as root

No USER directive exists in the runtime stage. Pre-existing; not introduced here.

---

What's correct

• Alpine 3.20 is EOL; 3.24 is the current stable with active advisories through 2028-06-01. The bump is the right call.
• RUN apk update && apk upgrade in the runtime stage correctly pulls the latest fixes from the 3.24 branch (including the libssl3/libcrypto3 fix noted in the PR body).
• Trivy workflow (trivy.yaml) is correctly pinned to a commit hash (57a97c7e…) and uses exit-code: "1", so the scan is enforcement, not advisory-only.
• The one-line diff is minimal and the change is straightforward.

---

Summary: Change is correct and necessary. The only blocker is rebasing onto master so the gRPC fix from #154 is included and Trivy CI passes.