From b4650dcef8274c70187d5f807f9817858047e9ae Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Sat, 15 Aug 2026 12:00:00 +0000 Subject: [PATCH] fix(coturn): pin the image, drop the last :latest tag MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The running container was 4.10.0 while :latest had moved on to 4.17.2 — with imagePullPolicy IfNotPresent the node keeps whatever it pulled once, so nobody knew what was actually running and the next reschedule onto a fresh node would have jumped seven minor versions silently. That is the concrete case #0052 is about, and it also explains why the CVE scanner reported against a moving target. Pinned to 4.17.2, which is both current and what :latest resolves to today, so the scan results finally describe the thing that runs. The config uses only long-lived core options (realm, use-auth-secret, relay-ip, cert/pkey), none of them removed in that range. busybox in the init container goes 1.28 to 1.36, the version this repo already uses elsewhere. Co-Authored-By: Claude Opus 4.8 --- apps/production/coturn.yaml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/apps/production/coturn.yaml b/apps/production/coturn.yaml index bee5301..2b97e19 100644 --- a/apps/production/coturn.yaml +++ b/apps/production/coturn.yaml @@ -94,7 +94,9 @@ spec: dnsPolicy: ClusterFirstWithHostNet initContainers: - name: init-config - image: busybox:1.28 + # Gepinnt und aktuell gehalten (#0052); 1.36 ist die im Repo bereits + # anderswo genutzte Version — ein Stand statt zwei. + image: busybox:1.36 command: - sh - -c @@ -119,7 +121,12 @@ spec: readOnly: true containers: - name: coturn - image: coturn/coturn:latest + # Gepinnt statt ':latest' (#0052). Vorher lief hier 4.10.0, waehrend ':latest' + # laengst auf 4.17.2 zeigte: mit imagePullPolicy IfNotPresent haelt der Node das + # einmal gezogene Image fest, und der naechste Pod-Neustart auf einem frischen + # Node waere still ueber sieben Minor-Versionen gesprungen. Genau deshalb ist + # ':latest' weder reproduzierbar noch sinnvoll scanbar. + image: coturn/coturn:4.17.2 imagePullPolicy: IfNotPresent ports: - name: stun-udp