From f9b86e6f53e83ea0b5e8de7c1c916196d3345aee Mon Sep 17 00:00:00 2001
From: Anso <dev@saelix.com>
Date: Sun, 29 Mar 2026 23:28:55 -0400
Subject: [PATCH] fix(docker): install Docker CLI v29.3.1 from static binaries
 to resolve CVEs (#268)

Alpine 3.23 ships docker-cli 29.1.3 which contains unpatched vulnerabilities:
- CVE-2026-33186 (Critical): gRPC-Go authorization bypass
- CVE-2026-34040 (High): Moby AuthZ plugin bypass
- CVE-2026-33747 (High): BuildKit path traversal via frontend
- CVE-2026-33748 (High): BuildKit path traversal via git URL

Replace apk-based docker-cli and docker-cli-compose with official static
binaries (Docker CLI v29.3.1 + Compose v2.40.3) pinned via build args.
---
 CHANGELOG.md |  1 +
 Dockerfile   | 21 ++++++++++++++++++---
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9157d4f8..eaca37de 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * **docker:** upgrade base image from `node:20-alpine` to `node:22-alpine` (Node 22.22.2 on Alpine 3.23.3) to remediate 31 CVEs (1 Critical, multiple High/Medium/Low) flagged by Docker Scout against the previous `node:20-alpine` base.
 * **docker:** add `apk upgrade --no-cache` to runtime stage to ensure all Alpine system packages are at their latest patched versions at build time.
 * **deps:** force `dompurify` to 3.3.3 via npm overrides to resolve two Dependabot advisories (Mutation-XSS via Re-Contextualization and Cross-site Scripting) in the transitive dependency pulled by `monaco-editor`.
+* **docker:** install Docker CLI v29.3.1 and Compose v2.40.3 from official static binaries instead of Alpine packages (which ship v29.1.3) to resolve CVE-2026-33186 (Critical), CVE-2026-34040 (High), CVE-2026-33747 (High), CVE-2026-33748 (High), and bundled Go stdlib CVEs.
 
 ### Fixed
 
diff --git a/Dockerfile b/Dockerfile
index 9512236f..65101ef2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -91,10 +91,25 @@ RUN if [ "$TARGETARCH" = "$BUILDARCH" ]; then \
 # Runs on the TARGET platform - no compilation happens here.
 FROM node:22-alpine
 
-# Upgrade all Alpine system packages to pick up security patches, then install
-# Docker CLI, Docker Compose CLI, and Bash for Host Console
+# Pin Docker CLI and Compose versions. Alpine 3.23 ships docker-cli 29.1.3
+# which contains unpatched CVEs (CVE-2026-33186 Critical, CVE-2026-34040 High,
+# CVE-2026-33747 High, CVE-2026-33748 High). Install from official static
+# binaries to get v29.3.1 which includes the fixes.
+ARG DOCKER_VERSION=29.3.1
+ARG COMPOSE_VERSION=v2.40.3
+
+# Upgrade all Alpine system packages, install runtime deps, then fetch Docker
+# CLI + Compose plugin from official static binaries.
 RUN apk upgrade --no-cache && \
-    apk add --no-cache docker-cli docker-cli-compose bash su-exec
+    apk add --no-cache bash su-exec curl && \
+    ARCH=$(uname -m) && \
+    curl -fsSL "https://download.docker.com/linux/static/stable/${ARCH}/docker-${DOCKER_VERSION}.tgz" \
+      | tar xz -C /usr/local/bin --strip-components=1 docker/docker && \
+    mkdir -p /usr/local/lib/docker/cli-plugins && \
+    curl -fsSL -o /usr/local/lib/docker/cli-plugins/docker-compose \
+      "https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-linux-${ARCH}" && \
+    chmod +x /usr/local/lib/docker/cli-plugins/docker-compose && \
+    apk del curl
 
 WORKDIR /app