title: Fixing security vulnerabilities in Cloud Function container
body: <p>The containers that result from the standard Cloud Function build/deploy process sometimes contain security vulnerabilities, and I'm not sure how to resolve these since Cloud Functions don't (as far as I know) offer much control of the execution environment by design. What's the best practice for resolving security vulnerabilities in Google Cloud Functions?</p>
  <p>If I can figure out how to extend the build process I think I'll be in good shape, but am not sure how to do that for Cloud Functions in particular.</p>
  <p>Situation:</p>
  <ul>
  <li><p>I'm building my functions using the standard <code>gcloud functions deploy</code> command (<a href="https://cloud.google.com/sdk/gcloud/reference/functions/deploy" rel="nofollow noreferrer">docs</a>). The deployment is successful and I can successfully run the function - it creates a container in the Container Registry (<a href="https://cloud.google.com/functions/docs/deploying" rel="nofollow noreferrer">process overview</a> -- sounds like its built off of the base Ubuntu Docker image).</p>
  </li>
  <li><p>I'm using Google's container vulnerability scanning, and it detects security issues in these containers, presumably because some of the packages in the Ubuntu base image have released security updates. In other container environments, its straightforward enough to update these packages via <code>apt</code> or similar, but I'm not aware of how to perform the equivalent in a Cloud Function environment since you don't really customize the environment (Dockerfile, etc).</p>
  </li>
  </ul>