Skip to content

Conversation

@MP-Tool
Copy link
Contributor

@MP-Tool MP-Tool commented Nov 7, 2025

Security: Upgrade Docker base images from Debian Bullseye to Bookworm

Problem

I stumbled upon critical CVEs in the Debian Bullseye base images currently used across all Dockerfiles.

Solution

Updated all Docker base images from Debian Bullseye to Bookworm (Debian 12):

  • rust:1.89.0-bullseyerust:1.89.0-bookworm
  • debian:bullseye-slimdebian:bookworm-slim
  • lukemathwalker/cargo-chef:latest-rust-1.89.0-bullseyelatest-rust-1.89.0-bookworm

Changes

  • 10 Dockerfiles updated (Periphery, Core, CLI, Binaries)
  • Rust version unchanged at 1.89.0 to avoid dependency issues
  • Only OS layer updated for security patches

Testing

✅ Successfully built and tested komodo-periphery:1.19.5 & komodo-core:1.19.5 with Bookworm
✅ All dependencies compatible with Debian 12
✅ No breaking changes in functionality

Note

This PR addresses security vulnerabilities. Feel free to use it if it fits your release cycle - no pressure!


Risk: Minimal - only OS security updates, no Rust version changes

@Lenart12
Copy link

If we are updating might as well update it to trixie instead of bookworm.

@MP-Tool
Copy link
Contributor Author

MP-Tool commented Nov 27, 2025

If we are updating might as well update it to trixie instead of bookworm.

I chosed Bookworm because Trixie was released only a few months ago. Bookworm currently has the more reliable LTS releases. In addition, Bookworm has support until 30 June 2028.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants