From 98cd876482cb0060b976f1e2cff1a4293c32ac03 Mon Sep 17 00:00:00 2001
From: David Haukeness <david@hauken.us>
Date: Thu, 12 Nov 2026 06:24:55 +0000
Subject: [PATCH] Upgrade OS packages in Docker images

The alpine, cloud and debian images are built on smallstep/step-cli,
which is only rebuilt when the CLI is released. Packages patched in
Alpine or Debian since then were shipped unpatched. Upgrade them in the
runtime stage, the same way the step-cli Dockerfiles already do.
---
 docker/Dockerfile        | 1 +
 docker/Dockerfile.cloud  | 3 +++
 docker/Dockerfile.debian | 1 +
 3 files changed, 5 insertions(+)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index 0718e0b..e8bef73 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -12,6 +12,7 @@ FROM smallstep/step-cli:latest
 COPY --from=builder /src/bin/step-kms-plugin /usr/local/bin/step-kms-plugin
 
 USER root
+RUN apk upgrade --no-cache
 RUN apk add --no-cache pcsc-lite pcsc-lite-libs
 USER step
 
diff --git a/docker/Dockerfile.cloud b/docker/Dockerfile.cloud
index f9eee9f..452d75c 100644
--- a/docker/Dockerfile.cloud
+++ b/docker/Dockerfile.cloud
@@ -8,6 +8,9 @@ RUN make V=1 CGO_ENABLED=0 build
 
 FROM smallstep/step-cli:latest
 
+USER root
+RUN apk upgrade --no-cache
+
 COPY --from=builder /src/bin/step-kms-plugin /usr/local/bin/step-kms-plugin
 
 USER step
diff --git a/docker/Dockerfile.debian b/docker/Dockerfile.debian
index e1a6e11..7036166 100644
--- a/docker/Dockerfile.debian
+++ b/docker/Dockerfile.debian
@@ -13,6 +13,7 @@ COPY --from=builder /src/bin/step-kms-plugin /usr/local/bin/step-kms-plugin
 
 USER root
 RUN apt-get update
+RUN apt-get upgrade -y
 RUN apt-get install -y --no-install-recommends pcscd libpcsclite1 p11-kit p11-kit-modules
 USER step