From af134cf48800dc6e326ee34783946d1acf059e33 Mon Sep 17 00:00:00 2001 From: Zyy Date: Mon, 7 Sep 2026 03:05:59 +0800 Subject: [PATCH] fix(docker): apply system updates to the runtime base image Upgrade installed Debian packages before adding runtime dependencies so digest-pinned base images receive available fixes, including the PCRE2 security update. Validation: rebuilt the amd64 runtime-base image without cache; Trivy reported zero fixable OS vulnerabilities across all severities; curl, pg_dump, and pg_restore started successfully as the cpr user. Co-authored-by: Codex --- deploy/Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/deploy/Dockerfile b/deploy/Dockerfile index 8e726a6b8..28134e792 100644 --- a/deploy/Dockerfile +++ b/deploy/Dockerfile @@ -46,7 +46,9 @@ ENV TZ=Asia/Shanghai # 运行时基础只从 Debian 官方源补 libpq（pg_dump 的动态依赖；ABI 兼容，无需引入第三方 # APT 源）。pg_dump/pg_restore 二进制由 pg-client stage COPY，构建期不依赖运行时安装。 +# 更新基础镜像已有的系统包，使固定 digest 的镜像也能获取 Debian 安全更新。 RUN apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y \ && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ca-certificates curl tzdata libpq5 \ && install -d /usr/lib/postgresql/18/bin \ && ln -snf "/usr/share/zoneinfo/${TZ}" /etc/localtime \