Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions Dockerfile.invoca
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
FROM golang:1.26 as build

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High IaC Finding

Missing User Instruction
on resource Dockerfile

More Details
This rule checks whether a `USER` instruction is specified in the Dockerfile. The rule fails when the `USER` instruction is missing, causing the container to run with root privileges (UID 0). If an attacker compromises an application running as root, they gain the privileges needed to potentially escape the container and attack the host node. It also increases the blast radius of a breach, allowing full control to modify files or install malware within the container. Enforcing a non-root user is a fundamental security measure that minimizes the attack surface and contains the impact of a potential compromise.

Expected

The multi-stage Dockerfile should contain at least one 'USER' instruction

Found

The multi-stage Dockerfile does not contain any 'USER' instruction

Security Frameworks: wf-id-264


Rule ID: fb18fd60-ca0d-4e75-98f1-720a8ec407d0


To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason

If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).


To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate


WORKDIR $GOPATH/src/github.com/thanos-io/thanos
COPY . $GOPATH/src/github.com/thanos-io/thanos
RUN git update-index --refresh; make build

FROM invocaops/base:master
COPY --from=build /go/bin/thanos /bin/thanos

ENTRYPOINT ["/bin/thanos"]
4 changes: 2 additions & 2 deletions cmd/thanos/query.go
Original file line numberDiff line numberDiff line change
Expand Up@@ -21,7 +21,6 @@ import (
"github.com/prometheus/common/route"
"github.com/prometheus/prometheus/model/labels"
"github.com/prometheus/prometheus/promql"
"github.com/prometheus/prometheus/promql/parser"

apiv1 "github.com/thanos-io/thanos/pkg/api/query"
"github.com/thanos-io/thanos/pkg/api/query/querypb"
Expand All@@ -34,6 +33,7 @@ import (
"github.com/thanos-io/thanos/pkg/extgrpc"
"github.com/thanos-io/thanos/pkg/extkingpin"
"github.com/thanos-io/thanos/pkg/extprom"
"github.com/thanos-io/thanos/pkg/extpromql"
extpromhttp "github.com/thanos-io/thanos/pkg/extprom/http"
"github.com/thanos-io/thanos/pkg/gate"
"github.com/thanos-io/thanos/pkg/info"
Expand DownExpand Up@@ -224,7 +224,7 @@ func registerQuery(app *extkingpin.App) {

for _, feature := range *featureList {
if feature == promqlExperimentalFunctions {
parser.EnableExperimentalFunctions = true
extpromql.SetEnableExperimentalFunctions(true)
level.Info(logger).Log("msg", "Experimental PromQL functions enabled.", "option", promqlExperimentalFunctions)
}
if feature == promqlAtModifier {
Expand Down
3 changes: 2 additions & 1 deletion cmd/thanos/query_frontend.go
Original file line numberDiff line numberDiff line change
Expand Up@@ -32,6 +32,7 @@ import (
"github.com/thanos-io/thanos/pkg/exthttp"
"github.com/thanos-io/thanos/pkg/extkingpin"
"github.com/thanos-io/thanos/pkg/extprom"
"github.com/thanos-io/thanos/pkg/extpromql"
extpromhttp "github.com/thanos-io/thanos/pkg/extprom/http"
"github.com/thanos-io/thanos/pkg/logging"
"github.com/thanos-io/thanos/pkg/prober"
Expand DownExpand Up@@ -310,7 +311,7 @@ func runQueryFrontend(
if len(cfg.EnableFeatures) > 0 {
for _, feature := range cfg.EnableFeatures {
if feature == promqlExperimentalFunctions {
parser.EnableExperimentalFunctions = true
extpromql.SetEnableExperimentalFunctions(true)
level.Info(logger).Log("msg", "Experimental PromQL functions enabled.", "option", promqlExperimentalFunctions)
}
}
Expand Down
4 changes: 2 additions & 2 deletions cmd/thanos/rule.go
Original file line numberDiff line numberDiff line change
Expand Up@@ -62,8 +62,8 @@ import (
"github.com/thanos-io/thanos/pkg/extgrpc"
"github.com/thanos-io/thanos/pkg/extkingpin"
"github.com/thanos-io/thanos/pkg/extprom"
extpromhttp "github.com/thanos-io/thanos/pkg/extprom/http"
"github.com/thanos-io/thanos/pkg/extpromql"
extpromhttp "github.com/thanos-io/thanos/pkg/extprom/http"
"github.com/thanos-io/thanos/pkg/info"
"github.com/thanos-io/thanos/pkg/info/infopb"
"github.com/thanos-io/thanos/pkg/logging"
Expand DownExpand Up@@ -602,7 +602,7 @@ func runRule(
if len(conf.EnableFeatures) > 0 {
for _, feature := range conf.EnableFeatures {
if feature == promqlExperimentalFunctions {
parser.EnableExperimentalFunctions = true
extpromql.SetEnableExperimentalFunctions(true)
level.Info(logger).Log("msg", "Experimental PromQL functions enabled.", "option", promqlExperimentalFunctions)
}
}
Expand Down
235 changes: 127 additions & 108 deletions go.mod

Large diffs are not rendered by default.

639 changes: 337 additions & 302 deletions go.sum

Large diffs are not rendered by default.

12 changes: 12 additions & 0 deletions internal/cortex/querier/series/series_set.go
Original file line numberDiff line numberDiff line change
Expand Up@@ -137,6 +137,10 @@ func (c *concreteSeriesIterator) AtT() int64 {
return t
}

func (c *concreteSeriesIterator) AtST() int64 {
return 0
}

func (c *concreteSeriesIterator) Next() chunkenc.ValueType {
c.cur++

Expand DownExpand Up@@ -185,6 +189,10 @@ func (errIterator) AtT() int64 {
return 0
}

func (errIterator) AtST() int64 {
return 0
}

func (e errIterator) Err() error {
return e.err
}
Expand DownExpand Up@@ -264,6 +272,10 @@ func (d DeletedSeriesIterator) AtT() int64 {
return t
}

func (d DeletedSeriesIterator) AtST() int64 {
return d.itr.AtST()
}

func (d DeletedSeriesIterator) Next() chunkenc.ValueType {
for valueType := d.itr.Next(); valueType != chunkenc.ValNone; valueType = d.itr.Next() {
ts, _ := d.itr.At()
Expand Down
2 changes: 1 addition & 1 deletion internal/cortex/util/metrics_helper.go
Original file line numberDiff line numberDiff line change
Expand Up@@ -14,7 +14,7 @@ import (
"github.com/prometheus/client_golang/prometheus"
dto "github.com/prometheus/client_model/go"
"github.com/prometheus/prometheus/model/labels"
tsdb_errors "github.com/prometheus/prometheus/tsdb/errors"
tsdb_errors "github.com/thanos-io/thanos/internal/tsdberrors"

util_log "github.com/thanos-io/thanos/internal/cortex/util/log"
)
Expand Down
12 changes: 12 additions & 0 deletions internal/promql-engine/.github/dependabot.yaml
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
---
version: 2
updates:
- package-ecosystem: "gomod"
directory: "/"
schedule:
interval: "weekly"
open-pull-requests-limit: 20
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: weekly
27 changes: 27 additions & 0 deletions internal/promql-engine/.github/workflows/docs.yaml
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
name: docs

on:
push:
branches:
- main
tags:
- '*'
pull_request:

jobs:
check:
runs-on: ubuntu-latest
name: Documentation check
env:
GOBIN: /tmp/.bin
steps:
- name: Checkout code into the Go module directory.
uses: actions/checkout@v4

- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version-file: go.mod

- name: Check docs
run: make check-docs
113 changes: 113 additions & 0 deletions internal/promql-engine/.github/workflows/test.yaml
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
name: Test

on:
push:
branches: [ main ]
pull_request:
branches: [ main, update-prometheus-3.0 ]

jobs:
skip-check:
name: Skip check
continue-on-error: true
runs-on: ubuntu-latest
outputs:
should_skip: ${{ steps.skip-check.outputs.should_skip }}
permissions:
actions: write
contents: read
steps:
- id: skip-check
uses: fkirc/skip-duplicate-actions@v4
with:
do_not_skip: '["schedule", "workflow_dispatch"]'
paths: |-
[
"**.go",
".github/workflows/test.yml",
"go.mod",
"go.sum"
]
skip_after_successful_duplicate: false

lint:
runs-on: ubuntu-latest
name: Linters (Static Analysis) for Go
env:
GOBIN: /tmp/.bin
steps:
- name: Checkout code into the Go module directory.
uses: actions/checkout@v4

- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version-file: go.mod
cache: true

- name: Cache binary dependencies
uses: actions/cache@v4
with:
path: /tmp/.bin
key: ${{ runner.os }}-binaries-${{ hashFiles('**/go.sum', '.bingo/**/*.sum') }}
restore-keys: |
${{ runner.os }}-binaries-

- name: Format
run: make format

- name: Lint
run: make lint
test:
runs-on: ubuntu-latest
name: Run tests
env:
GOBIN: /tmp/.bin
steps:
- name: Check out code into the Go module directory.
uses: actions/checkout@v4

- name: Install Go.
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version-file: go.mod
cache: true

- name: Run unit tests
run: make test

test-tag-slicelabels:
runs-on: ubuntu-latest
name: Run tests --tags=slicelabels
env:
GOBIN: /tmp/.bin
steps:
- name: Check out code into the Go module directory.
uses: actions/checkout@v4

- name: Install Go.
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version-file: go.mod
cache: true

- name: Run unit tests
run: make test-slicelabels

fuzz:
runs-on: ubuntu-latest
name: Run fuzz
env:
GOBIN: /tmp/.bin
steps:
- name: Check out code into the Go module directory.
uses: actions/checkout@v4

- name: Install Go.
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version-file: go.mod
cache: true

- name: Run fuzzing
run: make fuzz
17 changes: 17 additions & 0 deletions internal/promql-engine/.gitignore
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
.envrc
.bin

/vendor/

/.idea
/*.iml

tmp/
examples/tmp/

# Ignore the MacOS Trash (DS-Store)
.DS_Store

# Ignore benchmarking output
benchmarks/
engine.test
77 changes: 77 additions & 0 deletions internal/promql-engine/.golangci.yml
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
# This file contains all available configuration options
# with their default values.

# options for analysis running
run:
# timeout for analysis, e.g. 30s, 5m, default is 1m
timeout: 5m

# exit code when at least one issue was found, default is 1
issues-exit-code: 1

# output configuration options
output:
# colored-line-number|line-number|json|tab|checkstyle, default is "colored-line-number"
formats:
- format: colored-line-number

# print lines of code with issue, default is true
print-issued-lines: true

# print linter name in the end of issue text, default is true
print-linter-name: true

linters:
enable:
# Sorted alphabetically.
- errcheck
- godot
- gofmt
- gci
- gosimple
- govet
- ineffassign
- misspell
- staticcheck
- unparam
- unused
- copyloopvar
- promlinter

linters-settings:
errcheck:
exclude-functions:
- (github.com/go-kit/log.Logger).Log
- fmt.Fprintln
- fmt.Fprint
misspell:
locale: US
staticcheck:
checks:
- "all"
- "-SA1019" # Ignore deprecated warnings (labels.MetricName, LabelName.IsValid, etc.)
gci:
sections:
- standard
- prefix(github.com/thanos-io)
- default
- blank
- dot
skip-generated: false
custom-order: true

issues:
exclude-rules:
# We don't check metrics naming in the tests.
- path: _test\.go
linters:
- promlinter

# which dirs to skip: they won't be analyzed;
# can use regexp here: generated.*, regexp is applied on full path;
# default value is empty list, but next dirs are always skipped independently
# from this option's value:
# vendor$, third_party$, testdata$, examples$, Godeps$, builtin$
exclude-dirs:
- vendor
- parser
25 changes: 25 additions & 0 deletions internal/promql-engine/.mdox.validate.yaml
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
version: 1

validators:
# Validators to skip checking PR/issue links of Thanos, Prometheus and Cortex.
- regex: '(^http[s]?:\/\/)(www\.)?(github\.com\/)thanos-io\/thanos(\/pull\/|\/issues\/)'
type: 'githubPullsIssues'
- regex: '(^http[s]?:\/\/)(www\.)?(github\.com\/)prometheus\/prometheus(\/pull\/|\/issues\/)'
type: 'githubPullsIssues'
- regex: '(^http[s]?:\/\/)(www\.)?(github\.com\/)cortexproject\/cortex(\/pull\/|\/issues\/)'
type: 'githubPullsIssues'
# Ignore Thanos release links.
- regex: '(^http[s]?:\/\/)(www\.)?(github\.com\/)thanos-io\/thanos(\/releases\/)'
type: 'ignore'
# Causes http stream errors with statuscode 0 sometimes. But is safe to skip.
- regex: 'slack\.cncf\.io'
type: 'ignore'
# 301 errors even when curl-ed.
- regex: 'envoyproxy\.io'
type: 'ignore'
# couldn't reach even when curl-ed.
- regex: 'cloud\.baidu\.com'
type: 'ignore'
# 403 when curl-ed from GitHub actions, though not from a developer machine. Likely due to secondary rate limits.
- regex: 'docs\.github\.com'
type: 'ignore'
2 changes: 2 additions & 0 deletions internal/promql-engine/COPYRIGHT
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
Copyright (c) The Thanos Community Authors.
Licensed under the Apache License 2.0.
Loading
Loading