From b3a3c978e50f172e3d110fa67ab8c3cd94de7862 Mon Sep 17 00:00:00 2001 From: abhay084 Date: Tue, 14 Jul 2026 13:33:02 -0700 Subject: [PATCH] fix: [CI-23751]: bump kaniko-executor base to 1.25.16 to fix symlink regression kaniko-executor 1.25.15 (Chainguard fork) shipped an overly-strict securejoin path check (upstream PR #326) that rejects valid `..`-relative symlinks resolving to an in-image absolute path, e.g. the Java trust-store link /etc/pki/java/cacerts, failing the build during tar extraction with "symlink target ... resolves outside destination". Upstream fixed this in chainguard-forks/kaniko v1.25.16 (PR #440, "store symlink targets verbatim during tar extraction"). Bump FROM base image and KANIKO_VERSION 1.25.15 -> 1.25.16 across all registry variants (docker/ecr/gcr/acr/gar, amd64 + arm64). Depends on harnesscommunity/kaniko-executor:1.25.16-linux-{amd64,arm64} being published to Docker Hub before this can be built/released. Co-Authored-By: Claude Opus 4.8 --- docker/acr/Dockerfile.linux.amd64 | 4 ++-- docker/acr/Dockerfile.linux.arm64 | 4 ++-- docker/docker/Dockerfile.linux.amd64 | 4 ++-- docker/docker/Dockerfile.linux.arm64 | 4 ++-- docker/ecr/Dockerfile.linux.amd64 | 4 ++-- docker/ecr/Dockerfile.linux.arm64 | 4 ++-- docker/gar/Dockerfile.linux.amd64 | 4 ++-- docker/gar/Dockerfile.linux.arm64 | 4 ++-- docker/gcr/Dockerfile.linux.amd64 | 4 ++-- docker/gcr/Dockerfile.linux.arm64 | 4 ++-- 10 files changed, 20 insertions(+), 20 deletions(-) diff --git a/docker/acr/Dockerfile.linux.amd64 b/docker/acr/Dockerfile.linux.amd64 index aaae4fd..1032d31 100644 --- a/docker/acr/Dockerfile.linux.amd64 +++ b/docker/acr/Dockerfile.linux.amd64 @@ -1,5 +1,5 @@ -FROM harnesscommunity/kaniko-executor:1.25.15-linux-amd64 +FROM harnesscommunity/kaniko-executor:1.25.16-linux-amd64 -ENV KANIKO_VERSION=1.25.15 +ENV KANIKO_VERSION=1.25.16 ADD release/linux/amd64/kaniko-acr /kaniko/ ENTRYPOINT ["/kaniko/kaniko-acr"] diff --git a/docker/acr/Dockerfile.linux.arm64 b/docker/acr/Dockerfile.linux.arm64 index 5f9e8f8..729dbb8 100644 --- a/docker/acr/Dockerfile.linux.arm64 +++ b/docker/acr/Dockerfile.linux.arm64 @@ -1,8 +1,8 @@ -FROM harnesscommunity/kaniko-executor:1.25.15-linux-arm64 +FROM harnesscommunity/kaniko-executor:1.25.16-linux-arm64 ENV HOME /root ENV USER root -ENV KANIKO_VERSION=1.25.15 +ENV KANIKO_VERSION=1.25.16 ADD release/linux/arm64/kaniko-acr /kaniko/ ENTRYPOINT ["/kaniko/kaniko-acr"] diff --git a/docker/docker/Dockerfile.linux.amd64 b/docker/docker/Dockerfile.linux.amd64 index fef939b..4ebf3b2 100644 --- a/docker/docker/Dockerfile.linux.amd64 +++ b/docker/docker/Dockerfile.linux.amd64 @@ -1,5 +1,5 @@ -FROM harnesscommunity/kaniko-executor:1.25.15-linux-amd64 +FROM harnesscommunity/kaniko-executor:1.25.16-linux-amd64 -ENV KANIKO_VERSION=1.25.15 +ENV KANIKO_VERSION=1.25.16 ADD release/linux/amd64/kaniko-docker /kaniko/ ENTRYPOINT ["/kaniko/kaniko-docker"] diff --git a/docker/docker/Dockerfile.linux.arm64 b/docker/docker/Dockerfile.linux.arm64 index f0972b2..3f8a772 100644 --- a/docker/docker/Dockerfile.linux.arm64 +++ b/docker/docker/Dockerfile.linux.arm64 @@ -1,8 +1,8 @@ -FROM harnesscommunity/kaniko-executor:1.25.15-linux-arm64 +FROM harnesscommunity/kaniko-executor:1.25.16-linux-arm64 ENV HOME /root ENV USER root -ENV KANIKO_VERSION=1.25.15 +ENV KANIKO_VERSION=1.25.16 ADD release/linux/arm64/kaniko-docker /kaniko/ ENTRYPOINT ["/kaniko/kaniko-docker"] diff --git a/docker/ecr/Dockerfile.linux.amd64 b/docker/ecr/Dockerfile.linux.amd64 index a0249e5..6e5a0b4 100644 --- a/docker/ecr/Dockerfile.linux.amd64 +++ b/docker/ecr/Dockerfile.linux.amd64 @@ -1,5 +1,5 @@ -FROM harnesscommunity/kaniko-executor:1.25.15-linux-amd64 +FROM harnesscommunity/kaniko-executor:1.25.16-linux-amd64 -ENV KANIKO_VERSION=1.25.15 +ENV KANIKO_VERSION=1.25.16 ADD release/linux/amd64/kaniko-ecr /kaniko/ ENTRYPOINT ["/kaniko/kaniko-ecr"] diff --git a/docker/ecr/Dockerfile.linux.arm64 b/docker/ecr/Dockerfile.linux.arm64 index 533bd21..2c6f489 100644 --- a/docker/ecr/Dockerfile.linux.arm64 +++ b/docker/ecr/Dockerfile.linux.arm64 @@ -1,8 +1,8 @@ -FROM harnesscommunity/kaniko-executor:1.25.15-linux-arm64 +FROM harnesscommunity/kaniko-executor:1.25.16-linux-arm64 ENV HOME /root ENV USER root -ENV KANIKO_VERSION=1.25.15 +ENV KANIKO_VERSION=1.25.16 ADD release/linux/arm64/kaniko-ecr /kaniko/ ENTRYPOINT ["/kaniko/kaniko-ecr"] diff --git a/docker/gar/Dockerfile.linux.amd64 b/docker/gar/Dockerfile.linux.amd64 index 086226b..cfe50f5 100644 --- a/docker/gar/Dockerfile.linux.amd64 +++ b/docker/gar/Dockerfile.linux.amd64 @@ -1,5 +1,5 @@ -FROM harnesscommunity/kaniko-executor:1.25.15-linux-amd64 +FROM harnesscommunity/kaniko-executor:1.25.16-linux-amd64 -ENV KANIKO_VERSION=1.25.15 +ENV KANIKO_VERSION=1.25.16 ADD release/linux/amd64/kaniko-gar /kaniko/ ENTRYPOINT ["/kaniko/kaniko-gar"] diff --git a/docker/gar/Dockerfile.linux.arm64 b/docker/gar/Dockerfile.linux.arm64 index 025642c..ef75c7d 100644 --- a/docker/gar/Dockerfile.linux.arm64 +++ b/docker/gar/Dockerfile.linux.arm64 @@ -1,8 +1,8 @@ -FROM harnesscommunity/kaniko-executor:1.25.15-linux-arm64 +FROM harnesscommunity/kaniko-executor:1.25.16-linux-arm64 ENV HOME /root ENV USER root -ENV KANIKO_VERSION=1.25.15 +ENV KANIKO_VERSION=1.25.16 ADD release/linux/arm64/kaniko-gar /kaniko/ ENTRYPOINT ["/kaniko/kaniko-gar"] diff --git a/docker/gcr/Dockerfile.linux.amd64 b/docker/gcr/Dockerfile.linux.amd64 index 009461c..1f08eb3 100644 --- a/docker/gcr/Dockerfile.linux.amd64 +++ b/docker/gcr/Dockerfile.linux.amd64 @@ -1,5 +1,5 @@ -FROM harnesscommunity/kaniko-executor:1.25.15-linux-amd64 +FROM harnesscommunity/kaniko-executor:1.25.16-linux-amd64 -ENV KANIKO_VERSION=1.25.15 +ENV KANIKO_VERSION=1.25.16 ADD release/linux/amd64/kaniko-gcr /kaniko/ ENTRYPOINT ["/kaniko/kaniko-gcr"] diff --git a/docker/gcr/Dockerfile.linux.arm64 b/docker/gcr/Dockerfile.linux.arm64 index dfaa0bb..1b76604 100644 --- a/docker/gcr/Dockerfile.linux.arm64 +++ b/docker/gcr/Dockerfile.linux.arm64 @@ -1,8 +1,8 @@ -FROM harnesscommunity/kaniko-executor:1.25.15-linux-arm64 +FROM harnesscommunity/kaniko-executor:1.25.16-linux-arm64 ENV HOME /root ENV USER root -ENV KANIKO_VERSION=1.25.15 +ENV KANIKO_VERSION=1.25.16 ADD release/linux/arm64/kaniko-gcr /kaniko/ ENTRYPOINT ["/kaniko/kaniko-gcr"]