Pair Thanos 0.37.2 with Invoca Prometheus 2.55.1

[ColinDKelley]

Summary

• Replace embedded prometheus with Invoca fork at 82a784768
• Add Dockerfile.invoca using Go 1.23

Test plan

• make build

Made with Cursor

[wiz-b82ec45539]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	1  2
SAST Findings	-
Software Management Findings	-
Total	1  2

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[wiz-b82ec45539]

 IaC Finding

Missing User Instruction
on resource Dockerfile

More Details

This rule checks whether a `USER` instruction is specified in the Dockerfile. The rule fails when the `USER` instruction is missing, causing the container to run with root privileges (UID 0). If an attacker compromises an application running as root, they gain the privileges needed to potentially escape the container and attack the host node. It also increases the blast radius of a breach, allowing full control to modify files or install malware within the container. Enforcing a non-root user is a fundamental security measure that minimizes the attack surface and contains the impact of a potential compromise.

Expected

The multi-stage Dockerfile should contain at least one 'USER' instruction

Found

The multi-stage Dockerfile does not contain any 'USER' instruction

Security Frameworks: wf-id-264

Rule ID: fb18fd60-ca0d-4e75-98f1-720a8ec407d0

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason

If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate