Strip the build toolchain from the Docker runtime image (1.4.20)#120
Conversation
The php base image ships PHPIZE_DEPS (gcc, g++, make, autoconf, dpkg-dev, kernel headers, …) so extensions can compile at build time; none of it is needed at runtime. Purging it after install-php-extensions removes the largest CVE surface scanners flag on the image — linux-libc-dev alone accounted for 35 CRITICAL/HIGH findings; the sweep drops HIGH 150 -> 116 and halves MEDIUM (482 -> 241). Verified in the built image: imagick/gd/ intl/zip load, AVIF and HEIC encode work, the installer and translation seeding behave as before. Anyone extending the image with more PHP extensions should keep using install-php-extensions, which fetches its own build dependencies.
|
Warning Review limit reached
Next review available in: 51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Follow-up to #118: the runtime image still carried the php base image's PHPIZE_DEPS build toolchain (gcc, g++, make, autoconf, dpkg-dev, linux-libc-dev kernel headers, …). Nothing compiles at runtime, and those packages were the single largest CVE surface scanners flag — linux-libc-dev alone accounted for 35 CRITICAL/HIGH findings, all in unreachable code.
Purging the toolchain after
install-php-extensionsdrops the trivy counts from CRITICAL 15 / HIGH 150 / MEDIUM 482 to CRITICAL 14 / HIGH 116 / MEDIUM 241. Every remaining finding has no fix available in Debian trixie yet (affected/fix_deferred), and the app layer (npm/composer) reports zero vulnerabilities.Verified in the built image: imagick/gd/intl/zip load, AVIF and HEIC encode succeed, Apache serves, translation seeding and the installer behave as before. Version bumped to 1.4.20 for the image release tag.