From fefa8e438de5fb06ba3073072d9b8f1eb179ee01 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 2 Jun 2026 23:36:47 +0200 Subject: [PATCH] chore(docker): use nsjail runtime packages instead of dev packages (#9419) Swap the final-stage nsjail dependencies (libprotobuf-dev, libnl-route-3-dev) for their runtime-only counterparts (libprotobuf32, libnl-route-3-200, libnl-3-200) across the root Dockerfile, DockerfileSlim, and DockerfileSlimEe. nsjail is already compiled in the build stage, so the final image only needs the runtime shared libraries. This shrinks the images and reduces CVE scan noise from unused dev packages. Co-authored-by: Claude Opus 4.8 (1M context) --- Dockerfile | 2 +- docker/DockerfileSlim | 2 +- docker/DockerfileSlimEe | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 9062a4d9d8..14aa5363ef 100644 --- a/Dockerfile +++ b/Dockerfile @@ -300,7 +300,7 @@ ENV CARGO_HOME="/tmp/windmill/cache/cargo" ENV LD_LIBRARY_PATH="." # nsjail runtime deps and binary -RUN apt-get update && apt-get install -y libprotobuf-dev libnl-route-3-dev \ +RUN apt-get update && apt-get install -y --no-install-recommends libprotobuf32 libnl-route-3-200 libnl-3-200 \ && apt-get clean && rm -rf /var/lib/apt/lists/* COPY --from=nsjail /nsjail/nsjail /bin/nsjail diff --git a/docker/DockerfileSlim b/docker/DockerfileSlim index 3301d73506..b192a46c34 100644 --- a/docker/DockerfileSlim +++ b/docker/DockerfileSlim @@ -83,7 +83,7 @@ COPY --from=docker:29-dind /usr/local/bin/docker /usr/local/bin/ # nsjail runtime deps and binary RUN apt-get update \ - && apt-get install -y --no-install-recommends libprotobuf-dev libnl-route-3-dev \ + && apt-get install -y --no-install-recommends libprotobuf32 libnl-route-3-200 libnl-3-200 \ && apt-get clean && rm -rf /var/lib/apt/lists/* COPY --from=nsjail /nsjail/nsjail /bin/nsjail diff --git a/docker/DockerfileSlimEe b/docker/DockerfileSlimEe index 48cd3698a1..24d93586f8 100644 --- a/docker/DockerfileSlimEe +++ b/docker/DockerfileSlimEe @@ -83,7 +83,7 @@ COPY --from=docker:29-dind /usr/local/bin/docker /usr/local/bin/ # nsjail runtime deps and binary RUN apt-get update \ - && apt-get install -y --no-install-recommends libprotobuf-dev libnl-route-3-dev \ + && apt-get install -y --no-install-recommends libprotobuf32 libnl-route-3-200 libnl-3-200 \ && apt-get clean && rm -rf /var/lib/apt/lists/* COPY --from=nsjail /nsjail/nsjail /bin/nsjail