Remove go package from alpine

Question

I would like to build a base image starting from alpine and inserting only docker inside it.

What is not clear to me is why 'Go' with a vulnerable version (not the latest 17.7) is also brought inside. I've tried to force uninstall, but to no avail. The vulnerability scanner keeps finding me this package with version 17.1/17.2/17.3, but I don't understand how I can remove it to proceed to the build. Below is my Dockerfile:

FROM alpine
RUN apk add --no-cache docker

Does anyone have ideas on how to force the removal (or update eventually, of Go)?

Thanks

Answer 1

The OS images often have stale package lists, which you should update before installing anything. So do

FROM alpine
RUN apk update && apk add --no-cache docker