Alpine linux support

[ramijebara]

What

These changes represent an integration of existing community work that I have used to add support for an Alpine Linux Docker Build.

The bases for the work comes from the Alpine Community Repository changes.

This work was tested on AMD64 and ARM64 CPU architectures.

Why

The Debian slim based container usually fails compliance scans due to outdated packages or known vulnerabilities. Alpine is more lightweight and will pass compliance container scans more often then not.

References

This change was initially proposed in PR#81

jira issue reference: SC-953 SC-961 // this line was added by ArnoStiefvater

[ArnoStiefvater]

Hey @ramijebara,

Thanks again for this PR!

I personally think that this is a pretty good idea but need more information first to be able to weigh the consequences.

How does your current deployment look like in which you use the openvas-smb image?
Do you run the other openvas components (openvas-scanner, gvm-libs, ospd-openvas, notus-scanner) also with alpine based images?

I have looked into https://git.alpinelinux.org/aports/tree/community and our other components are also present there.
Would you be willing to add and maintain support for alpine based images for those repos too if we decide to generally add alpine as supported platform? Else there would only be Alpine available for openvas-smb. We would like to either have all our components support Alpine or None, else its very inconsistent which is not something we want. Unfortunately we currently do not have the resources to support 2 platforms for the community on our own.

[ramijebara]

Hi @ArnoStiefvater

You are welcome!

Deployment is docker based, all alpine based. Though we are fans of Debian, we find alpine images lighter and easier to maintain when doing continuous security and compliance scans.

I do not use or run any other Openvas components at this time.

I do understand where you are coming from about consistency. I would have the same concern, to be honest.

Since I am not familiar with the other Openvas components, Can I take a look and get back to you by the end of the week?

[ArnoStiefvater]

Sure, the repos/components are: openvas-scanner, gvm-libs and ospd-openvas. notus-scanner is actually not needed for us.

I also would like to mention that we have reverted your PR #83 with #84. See the description for details. If this is not sufficient enough please let me know if you have an alternative solution in mind. Please create a new issue for discussion if needed/wanted.

[ramijebara]

Hi @ArnoStiefvater sure, I will take a look at those 3 projects.