docker: Refresh base images and trim runtime dependencies - #6701
Open
incrypto32 wants to merge 3 commits into
Open
docker: Refresh base images and trim runtime dependencies#6701incrypto32 wants to merge 3 commits into
incrypto32 wants to merge 3 commits into
Conversation
The runtime base was frozen at the bookworm-20241111-slim snapshot, so the image never picked up Debian security updates, while the golang and rust build stages floated on rolling tags. Pin all three by multi-arch index digest instead: reproducible builds, and dependabot can track the tags.
graph-node and graphman link libpq.so.5, which libpq5 provides. libpq-dev only adds headers, libpq.a and pg_config, none of which the runtime image uses, and it pulled in libssl-dev as a dependency.
incrypto32
force-pushed
the
incrypto32/docker-base-refresh
branch
from
July 29, 2026 10:54
06ecfc1 to
8046822
Compare
Keeps the pinned digests current so the runtime image picks up Debian security updates instead of drifting behind again.
incrypto32
force-pushed
the
incrypto32/docker-base-refresh
branch
from
July 29, 2026 11:13
8046822 to
89e6627
Compare
incrypto32
marked this pull request as ready for review
July 29, 2026 13:27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The runtime base was pinned to a Nov 2024 Debian snapshot, so the image never picked up security updates, while the golang and rust build stages floated on rolling tags.
libpq5instead oflibpq-devin the runtime image. graph-node and graphman linklibpq.so.5; the-devpackage only adds headers and static libs, and pulled inlibssl-devwith itVerified with a full source build: both binaries run,
lddfully resolved,ncstill present forwait_for, and no dev packages left in the image.