starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-18 08:01:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reduce slim image vulnerability surface (#9279)

Browse Source 
* Reduce slim image vulnerability surface

* chore(docker): drop apt-get upgrade -y from slim images

apt-get upgrade hurts build reproducibility (same Dockerfile + same
commit at different times produces divergent images) and trips hadolint
DL3005. The freshness it buys is dominated by simply rebuilding against
the periodically-refreshed debian:bookworm-slim base image.

The --no-install-recommends and apt-list cleanup wins are kept.

---------

Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
This commit is contained in:
Aldrin Jenson
2026-05-22 02:39:36 -04:00
committed by GitHub
parent 72e2c3a6b3
commit 88294182c0
3 changed files with 18 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/DockerfileSlim
+9 -4
View File
@@ -5,8 +5,9 @@ FROM debian:bookworm-slim AS nsjail
WORKDIR /nsjail
RUN apt-get -y update \
&& apt-get install -y \
&& apt-get install -y --no-install-recommends \
bison=2:3.8.* \
ca-certificates \
flex=2.6.* \
g++=4:12.2.* \
gcc=4:12.2.* \
@@ -15,7 +16,9 @@ RUN apt-get -y update \
libnl-route-3-dev=3.7.* \
make=4.3-4.1 \
pkg-config=1.8.* \
protobuf-compiler=3.21.*
protobuf-compiler=3.21.* \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
RUN git clone -b master --single-branch https://github.com/google/nsjail.git . && git checkout dccf911fd2659e7b08ce9507c25b2b38ec2c5800
RUN make
@@ -36,7 +39,8 @@ ENV PATH=/usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH
# Install system dependencies
RUN apt-get update \
&& apt-get install -y ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release \
&& apt-get install -y --no-install-recommends ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
# Install latest PostgreSQL client (pg_dump) from official PostgreSQL apt repository
@@ -78,7 +82,8 @@ RUN curl -fsSL https://claude.ai/install.sh | bash \
COPY --from=docker:29-dind /usr/local/bin/docker /usr/local/bin/
# nsjail runtime deps and binary
RUN apt-get update && apt-get install -y libprotobuf-dev libnl-route-3-dev \
RUN apt-get update \
&& apt-get install -y --no-install-recommends libprotobuf-dev libnl-route-3-dev \
&& apt-get clean && rm -rf /var/lib/apt/lists/*
COPY --from=nsjail /nsjail/nsjail /bin/nsjail
docker/DockerfileSlimEe
+9 -4
View File
@@ -5,8 +5,9 @@ FROM debian:bookworm-slim AS nsjail
WORKDIR /nsjail
RUN apt-get -y update \
&& apt-get install -y \
&& apt-get install -y --no-install-recommends \
bison=2:3.8.* \
ca-certificates \
flex=2.6.* \
g++=4:12.2.* \
gcc=4:12.2.* \
@@ -15,7 +16,9 @@ RUN apt-get -y update \
libnl-route-3-dev=3.7.* \
make=4.3-4.1 \
pkg-config=1.8.* \
protobuf-compiler=3.21.*
protobuf-compiler=3.21.* \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
RUN git clone -b master --single-branch https://github.com/google/nsjail.git . && git checkout dccf911fd2659e7b08ce9507c25b2b38ec2c5800
RUN make
@@ -36,7 +39,8 @@ ENV PATH=/usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH
# Install system dependencies
RUN apt-get update \
&& apt-get install -y ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release \
&& apt-get install -y --no-install-recommends ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
# Install latest PostgreSQL client (pg_dump) from official PostgreSQL apt repository
@@ -78,7 +82,8 @@ RUN curl -fsSL https://claude.ai/install.sh | bash \
COPY --from=docker:29-dind /usr/local/bin/docker /usr/local/bin/
# nsjail runtime deps and binary
RUN apt-get update && apt-get install -y libprotobuf-dev libnl-route-3-dev \
RUN apt-get update \
&& apt-get install -y --no-install-recommends libprotobuf-dev libnl-route-3-dev \
&& apt-get clean && rm -rf /var/lib/apt/lists/*
COPY --from=nsjail /nsjail/nsjail /bin/nsjail
frontend/src/lib/hubPaths.json
-30
View File
@@ -1,41 +1,11 @@
{
"deprecated_gitSync_0": "hub/9087/sync-script-to-git-repo-windmill",
"deprecated_gitSync_1": "hub/9987/sync-script-to-git-repo-windmill",
"deprecated_gitSync_2": "hub/11498/sync-script-to-git-repo-windmill",
"deprecated_gitSync_3": "hub/11533/sync-script-to-git-repo-windmill",
"deprecated_gitSync_4": "hub/11580/sync-script-to-git-repo-windmill",
"deprecated_gitSync_5": "hub/11641/sync-script-to-git-repo-windmill",
"deprecated_gitSync_6": "hub/11666/sync-script-to-git-repo-windmill",
"deprecated_gitSync_7": "hub/11668/sync-script-to-git-repo-windmill",
"deprecated_gitSync_8": "hub/19673/sync-script-to-git-repo-windmill",
"deprecated_gitSync_9": "hub/19738/sync-script-to-git-repo-windmill",
"deprecated_gitSync_10": "hub/19785/sync-script-to-git-repo-windmill",
"deprecated_gitSync_11": "hub/19789/sync-script-to-git-repo-windmill",
"deprecated_gitSync_12": "hub/19798/sync-script-to-git-repo-windmill",
"deprecated_gitSync_13": "hub/19801/sync-script-to-git-repo-windmill",
"deprecated_gitSync_14": "hub/19803/sync-script-to-git-repo-windmill",
"deprecated_gitSync_15": "hub/19816/sync-script-to-git-repo-windmill",
"deprecated_gitSync_16": "hub/19818/sync-script-to-git-repo-windmill",
"deprecated_gitSync_17": "hub/28073/sync-script-to-git-repo-windmill",
"deprecated_gitSync_18": "hub/28078/sync-script-to-git-repo-windmill",
"deprecated_gitSync_19": "hub/28081/sync-script-to-git-repo-windmill",
"deprecated_gitSync_20": "hub/28102/sync-script-to-git-repo-windmill",
"deprecated_gitSync_21": "hub/28131/sync-script-to-git-repo-windmill",
"deprecated_gitSync_22": "hub/28159/sync-script-to-git-repo-windmill",
"deprecated_gitSync_23": "hub/28160/sync-script-to-git-repo-windmill",
"deprecated_gitSync_24": "hub/28176/sync-script-to-git-repo-windmill",
"deprecated_gitSync_latest": "hub/28180/sync-script-to-git-repo-windmill",
"deprecated_gitSync_25": "hub/28183/sync-script-to-git-repo-windmill",
"gitSyncTest": "hub/28184/git-repo-test-read-write-windmill",
"gitInitRepo": "hub/28219/git-sync%3A-init-repository-windmill",
"slackErrorHandler": "hub/19741/workspace-or-schedule-error-handler-slack",
"slackErrorHandler_0": "hub/9079/workspace-or-schedule-error-handler-slack",
"slackErrorHandler_1": "hub/9206/workspace-or-schedule-error-handler-slack",
"emailErrorHandler": "hub/19795/workspace-or-error-handler-email",
"slackRecoveryHandler": "hub/9080/slack/schedule-recovery-handler-slack",
"slackSuccessHandler": "hub/28220/slack/schedule-success-handler-slack",
"teamsErrorHandler": "hub/19742/workspace-or-schedule-error-handler-teams",
"teamsErrorHandler_0": "hub/11598/workspace-or-schedule-error-handler-teams",
"teamsRecoveryHandler": "hub/11593/schedule-recovery-handler-teams",
"teamsSuccessHandler": "hub/11596/schedule-success-handler-teams",
"slackReport": "hub/9084/slack",