From 21c80fc2494a2ca89a99d42dbfee0d5eca741825 Mon Sep 17 00:00:00 2001 From: "avi@robusta.dev" Date: Wed, 14 Oct 2026 10:48:07 +0300 Subject: [PATCH 1/4] Drop awscli from runtime image to remove python CVEs awscli pulls in python3.11, expat, urllib3, cryptography, pyasn1 and sqlite, and is only used by run.sh when GENERATE_CLUSTER_CERTS is set, which the Robusta chart never sets. Co-Authored-By: Claude Opus 5.5 (1M context) --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index d53bc5bef..5587db000 100644 --- a/Dockerfile +++ b/Dockerfile @@ -84,7 +84,7 @@ ENV SLOT_NAME_SUFFIX="${SLOT_NAME_SUFFIX}" \ RUN apt-get update -y && \ apt-get upgrade -y --no-install-recommends && \ apt-get install -y --no-install-recommends \ - libstdc++6 openssl libncurses5 locales iptables sudo tini curl awscli jq xz-utils && \ + libstdc++6 openssl libncurses5 locales iptables sudo tini curl jq xz-utils && \ apt-get clean && rm -rf /var/lib/apt/lists/* # Robusta: pgdelta artifacts copied from the upstream realtime image. From 08c2fcf3f4ebe1822b3e996701393f6fd9b90b6d Mon Sep 17 00:00:00 2001 From: "avi@robusta.dev" Date: Thu, 15 Oct 2026 11:21:02 +0300 Subject: [PATCH 2/4] Revert "Drop awscli from runtime image to remove python CVEs" This reverts commit 21c80fc2494a2ca89a99d42dbfee0d5eca741825. --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 5587db000..d53bc5bef 100644 --- a/Dockerfile +++ b/Dockerfile @@ -84,7 +84,7 @@ ENV SLOT_NAME_SUFFIX="${SLOT_NAME_SUFFIX}" \ RUN apt-get update -y && \ apt-get upgrade -y --no-install-recommends && \ apt-get install -y --no-install-recommends \ - libstdc++6 openssl libncurses5 locales iptables sudo tini curl jq xz-utils && \ + libstdc++6 openssl libncurses5 locales iptables sudo tini curl awscli jq xz-utils && \ apt-get clean && rm -rf /var/lib/apt/lists/* # Robusta: pgdelta artifacts copied from the upstream realtime image. From fbf97cb7d86144aff8e9d115545ba68bdf992820 Mon Sep 17 00:00:00 2001 From: "avi@robusta.dev" Date: Thu, 15 Oct 2026 11:21:07 +0300 Subject: [PATCH 3/4] ROB-1611 Move runtime to trixie and pin CVE fixes from forky Same approach as the robusta runner image: trixie runtime plus a per-package forky pin for CVEs trixie has no fix for (glibc, perl, util-linux, curl, expat, ncurses, systemd, python3.13, pyasn1, sudo, ...). libncurses5 is dropped since the release only links libtinfo6. Co-Authored-By: Claude Opus 5.5 (1M context) --- Dockerfile | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index d53bc5bef..3138332dd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ ARG ELIXIR_VERSION=1.18 ARG OTP_VERSION=27.3 ARG DEBIAN_VERSION=bookworm-20250929-slim ARG BUILDER_IMAGE="hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}" -ARG RUNNER_IMAGE="debian:${DEBIAN_VERSION}" +ARG RUNNER_IMAGE="debian:trixie-slim" # Robusta: reuse the prebuilt pgdelta + libpg-query artifacts from the # upstream supabase/realtime image instead of running the heavy @@ -84,7 +84,21 @@ ENV SLOT_NAME_SUFFIX="${SLOT_NAME_SUFFIX}" \ RUN apt-get update -y && \ apt-get upgrade -y --no-install-recommends && \ apt-get install -y --no-install-recommends \ - libstdc++6 openssl libncurses5 locales iptables sudo tini curl awscli jq xz-utils && \ + libstdc++6 openssl locales iptables sudo tini curl awscli jq xz-utils && \ + apt-get clean && rm -rf /var/lib/apt/lists/* + +# Robusta: pull CVE fixes trixie lacks from forky, pinned per package. +RUN FORKY_PKGS="libc6 libc-bin libc-l10n libc-gconv-modules-extra libcrypt1 locales \ + libncursesw6 libtinfo6 ncurses-base ncurses-bin perl-base libsystemd0 libudev1 \ + util-linux bsdutils mount login libblkid1 libmount1 libsmartcols1 liblastlog2-2 libuuid1 \ + libexpat1 python3.13 python3.13-minimal libpython3.13-minimal libpython3.13-stdlib \ + python3-cryptography python3-urllib3 python3-pyasn1 libsqlite3-0 zlib1g libacl1 libattr1 \ + curl libcurl4t64 libnghttp2-14 libnghttp3-9 libngtcp2-16 libngtcp2-crypto-ossl0 libp11-kit0 sudo" && \ + echo 'deb http://deb.debian.org/debian forky main' > /etc/apt/sources.list.d/forky.list && \ + printf "Package: $FORKY_PKGS\nPin: release n=forky\nPin-Priority: 990\n\nPackage: *\nPin: release n=forky\nPin-Priority: -1\n" > /etc/apt/preferences.d/99-forky && \ + apt-get update -y && \ + apt-get install -y --no-install-recommends $FORKY_PKGS && \ + rm -f /etc/apt/sources.list.d/forky.list /etc/apt/preferences.d/99-forky && \ apt-get clean && rm -rf /var/lib/apt/lists/* # Robusta: pgdelta artifacts copied from the upstream realtime image. From 4a6081ed37a105d86eddd7aff747147055a579f5 Mon Sep 17 00:00:00 2001 From: "avi@robusta.dev" Date: Thu, 15 Oct 2026 11:22:32 +0300 Subject: [PATCH 4/4] ROB-1611 Note DEBIAN_VERSION only applies to the builder Co-Authored-By: Claude Opus 5.5 (1M context) --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index 3138332dd..350faed20 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,6 @@ ARG ELIXIR_VERSION=1.18 ARG OTP_VERSION=27.3 +# Robusta: builder only; runner uses trixie for CVE fixes. ARG DEBIAN_VERSION=bookworm-20250929-slim ARG BUILDER_IMAGE="hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}" ARG RUNNER_IMAGE="debian:trixie-slim"