Comments (5)
It would be great if we added the following. This is a saved reply we have sent before from the Support email team:
Please note that the Matomo docker images do not form part of our automated security assessments and vulnerability scans. We only do this for the Matomo codebase itself.
If you need to fix this in order to deploy the container to your network, then there are a few options available to you:
- Build your own docker image to be used for your Matomo deployment. For our security-focused users, this is going to be the best method available as it ensures you have complete and full control of all dependencies and packages installed in the container itself or
- Update the vulnerable packages in the docker image and save the patched image as your base image for deployment. This is likely the easiest solution if you don't want to go through the process of building your own docker image from scratch. The process of updating packages and committing the changes to the base image is out of the scope of our support, but there are several guides online that you can use to make the necessary changes to your docker image.
from docker.
Ugh. Given the mishaps in getting the container up for a quick assessment/demo + this issue informing me of "complete and full control of all dependencies and packages..." leads to my confidence in this project quickly waning.
We expect project owners to not only offer containers, but also ensure integrity with their container offerings. My team is focused on delivering results rather than goose chase finger traps. No container or neglected container is so last century.
We may revisit sometime next year.
from docker.
@ezekieldas thank you for your feedback. We will pass it onto the product team.
In the meantime, you can browse the free demo on https://demo.matomo.cloud/ or quickly establish a free trial with all the premium features via https://matomo.org and https://matomo.org/lets-get-started/.
from docker.
See also https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves
from docker.
We had another user today report that they use this matomo docker image "as is", without customizing it.
from docker.
Related Issues (20)
- LoginSaml Logs that the response was recieved at a different endpoint
- difference in nginx template and docker template
- Tracking code verification failed. Please verify that you have installed the code correctly
- nginx config differs from official documentation
- Version 5.0.1 not updated after docker pull HOT 2
- Matomo Web UI doesn't recognize new Version
- LOAD DATA INFILE - warning that wasn't in versions before
- SSL Certificate Expiry Issue HOT 1
- docker version mamoto db connection failed with latest version of mariadb
- Does not work - Cannot connect to DB HOT 2
- Upgrading HOT 4
- Docker container stops after a day or two with message "caught SIGWINCH, shutting down gracefully"
- Add an environment variable to rename matomo.js and matomo.php
- Feature request: Don't compress Matomo within the container
- Feature request: Kubernetes-specific container HOT 1
- Getting error server reached MaxRequestWorkers HOT 1
- Increase max execution time
- Docker image vulnerabilities HOT 1
- [Bug] PHP 8.2 and 8.3 breaks the SSL connection to Matomo's database
- 5.1.1 build is broken
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from docker.