Skip to content

ROB-1611 Fix CVEs in the realtime image: trixie runtime + forky pins #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RoiGlinik merged 4 commits into from
Oct 15, 2026
Merged

ROB-1611 Fix CVEs in the realtime image: trixie runtime + forky pins #3

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
21c80fc
Drop awscli from runtime image to remove python CVEs
Avi-Robusta Oct 14, 2026
08c2fcf
Revert "Drop awscli from runtime image to remove python CVEs"
Avi-Robusta Oct 15, 2026
fbf97cb
ROB-1611 Move runtime to trixie and pin CVE fixes from forky
Avi-Robusta Oct 15, 2026
4a6081e
ROB-1611 Note DEBIAN_VERSION only applies to the builder
Avi-Robusta Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
ARG ELIXIR_VERSION=1.18
ARG OTP_VERSION=27.3
# Robusta: builder only; runner uses trixie for CVE fixes.
ARG DEBIAN_VERSION=bookworm-20250929-slim
ARG BUILDER_IMAGE="hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-debian-${DEBIAN_VERSION}"
ARG RUNNER_IMAGE="debian:${DEBIAN_VERSION}"
ARG RUNNER_IMAGE="debian:trixie-slim"

# Robusta: reuse the prebuilt pgdelta + libpg-query artifacts from the
# upstream supabase/realtime image instead of running the heavy
Expand Down Expand Up @@ -84,7 +85,21 @@ ENV SLOT_NAME_SUFFIX="${SLOT_NAME_SUFFIX}" \
RUN apt-get update -y && \
apt-get upgrade -y --no-install-recommends && \
apt-get install -y --no-install-recommends \
libstdc++6 openssl libncurses5 locales iptables sudo tini curl awscli jq xz-utils && \
libstdc++6 openssl locales iptables sudo tini curl awscli jq xz-utils && \
apt-get clean && rm -rf /var/lib/apt/lists/*

# Robusta: pull CVE fixes trixie lacks from forky, pinned per package.
RUN FORKY_PKGS="libc6 libc-bin libc-l10n libc-gconv-modules-extra libcrypt1 locales \
libncursesw6 libtinfo6 ncurses-base ncurses-bin perl-base libsystemd0 libudev1 \
util-linux bsdutils mount login libblkid1 libmount1 libsmartcols1 liblastlog2-2 libuuid1 \
libexpat1 python3.13 python3.13-minimal libpython3.13-minimal libpython3.13-stdlib \
python3-cryptography python3-urllib3 python3-pyasn1 libsqlite3-0 zlib1g libacl1 libattr1 \
curl libcurl4t64 libnghttp2-14 libnghttp3-9 libngtcp2-16 libngtcp2-crypto-ossl0 libp11-kit0 sudo" && \
echo 'deb http://deb.debian.org/debian forky main' > /etc/apt/sources.list.d/forky.list && \
printf "Package: $FORKY_PKGS\nPin: release n=forky\nPin-Priority: 990\n\nPackage: *\nPin: release n=forky\nPin-Priority: -1\n" > /etc/apt/preferences.d/99-forky && \
apt-get update -y && \
apt-get install -y --no-install-recommends $FORKY_PKGS && \
rm -f /etc/apt/sources.list.d/forky.list /etc/apt/preferences.d/99-forky && \
apt-get clean && rm -rf /var/lib/apt/lists/*

# Robusta: pgdelta artifacts copied from the upstream realtime image.
Expand Down
Loading