Starting in CloudBees CI version 2.580.2.38434, the default CloudBees CI agent image (cloudbees-core-agent) no longer includes Git Large File Storage (Git LFS).
Git LFS is distributed as a Go binary, and security scanners frequently flag it for the version of the Go runtime it embeds, even when the reported vulnerabilities are not reachable and do not affect the binary. Removing Git LFS from the default agent image eliminates this recurring, non-actionable scanner noise for the majority of users who do not use Git LFS.
For users whose pipelines require Git LFS, CloudBees provides a separate agent image variant that includes it: cloudbees-core-agent-git-lfs.
|
The Git LFS agent image variant is available for Linux only. There is no Windows Git LFS agent image. |
Enable the Git LFS agent image
If you install CloudBees CI using Helm, set Agents.UseGitLfsImage to true in your values.yaml to make the default Kubernetes build agent use the Git LFS image variant:
Agents: UseGitLfsImage: true
When enabled, the agent image repository is suffixed with -git-lfs (for example, cloudbees-core-agent becomes cloudbees-core-agent-git-lfs).
The registry and tag are otherwise unchanged.
Git LFS security and support policy
CloudBees does not act on security vulnerabilities reported against Git LFS in the Git LFS agent image unless a fix is available and not yet included in the image.
Updates to the Git LFS agent image follow the standard CloudBees CI release schedule and cadence. Git LFS is installed from the Red Hat Universal Base Image (UBI) package repositories, so Git LFS updates are delivered as part of the regular base image updates.