Skip to content

feat: Cronos mainnet image bump v1.4.11 #84

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 14, 2025
Merged

feat: Cronos mainnet image bump v1.4.11 #84

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 6 additions & 17 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,19 @@
FROM debian:bullseye-slim

# Create user & directories
RUN adduser --disabled-password --gecos "" --no-create-home --uid 1000 cronos \
&& mkdir -p /home/cronos/data /home/cronos/config /home/cronos/bin
RUN adduser --disabled-password --gecos "" --no-create-home --uid 1000 cronos
RUN mkdir -p /home/cronos/data && mkdir -p /home/cronos/config

# Install dependencies
RUN apt-get update -y && apt-get install -y wget curl procps net-tools jq lz4

WORKDIR /tmp
RUN apt-get update -y && apt-get install wget curl procps net-tools jq lz4 -y

# Download and verify tarball
RUN wget https://github.com/crypto-org-chain/cronos/releases/download/v1.5.0/cronos_1.5.0-testnet_Linux_x86_64.tar.gz \
&& echo "d917ca990ed2415905a44ec48d6047664dad06b3441cd09b116f86f1880b1c2b cronos_1.5.0-testnet_Linux_x86_64.tar.gz" | sha256sum -c -

# Extract and move binary
RUN tar -xzf cronos_1.5.0-testnet_Linux_x86_64.tar.gz \
&& mv bin/cronosd /home/cronos/bin/cronosd \
&& rm -rf cronos_1.5.0-testnet_Linux_x86_64 cronos_1.5.0-testnet_Linux_x86_64.tar.gz

# Validate binary hash
RUN sha256sum /home/cronos/bin/cronosd
RUN cd /tmp && wget --no-check-certificate https://github.com/crypto-org-chain/cronos/releases/download/v1.4.11/cronos_1.4.11_Linux_x86_64.tar.gz && tar -xvf cronos_1.4.11_Linux_x86_64.tar.gz \
&& rm cronos_1.4.11_Linux_x86_64.tar.gz && mv ./* /home/cronos/
Comment on lines +11 to +12
Copy link

@coderabbitai coderabbitai bot Oct 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Reinstate TLS and checksum verification for the Cronos tarball.

wget --no-check-certificate disables TLS validation and the checksum verification step has been dropped, so we now pipe an unauthenticated binary straight into the image. This is a critical supply-chain regression relative to the previous Dockerfile. Please restore CA verification and the SHA256 (or stronger) digest check before we can ship.

🧰 Tools
🪛 Checkov (3.2.334)

[high] 11-12: Ensure that certificate validation isn't disabled with wget

(CKV2_DOCKER_3)

🤖 Prompt for AI Agents 
In Dockerfile around lines 11-12, restore TLS and checksum verification for the
Cronos tarball: remove the wget --no-check-certificate usage (use curl -fSL or
wget with default TLS), fetch the official release checksum (or
.sha256/.sha256sum file) from the same GitHub release, verify the downloaded
tarball against the expected SHA256 (e.g., using sha256sum --check or echo
"<expected>  file" | sha256sum -c -) and exit/ fail the build if the digest does
not match, then only extract and move the archive; also clean up checksum and
signature files after verification. Ensure commands return non-zero on
verification failure so the image build cannot proceed with an unauthenticated
artifact.


# Set permissions
RUN chown -R cronos:cronos /home/cronos && chmod 1777 /tmp

USER cronos
WORKDIR /home/cronos
USER root
Copy link

@coderabbitai coderabbitai bot Oct 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Revert to the non-root runtime user.

Switching the container back to USER root removes the least-privilege protection we previously had. The cronos daemon does not require root inside the container, so this change reintroduces an avoidable security risk. Please keep running as the dedicated cronos user.

🤖 Prompt for AI Agents 
In Dockerfile around line 17, the PR changed the runtime user to "root" which
removes least-privilege protection; revert this to the dedicated non-root user
(e.g., USER cronos) and ensure any files or directories the container needs at
runtime are owned by that user and have the correct permissions (chown/chmod
during image build or COPY --chown) so the cronos daemon can run without root
privileges. Ensure the ENTRYPOINT/CMD and any startup scripts are executable by
the cronos user.


ENTRYPOINT ["/home/cronos/bin/cronosd"]