build(docker): postgresql-client instead of full postgresql server + sqlite3 - #153
Open
onelapahead wants to merge 2 commits into
Open
build(docker): postgresql-client instead of full postgresql server + sqlite3#153onelapahead wants to merge 2 commits into
onelapahead wants to merge 2 commits into
Conversation
…erver and sqlite3 Nothing in FireFly executes external database binaries: the postgres and sqlite3 plugins use in-process database/sql drivers, and migrations run via golang-migrate as a library. The psql client was originally added as a debugging utility (73a4ef7, on Alpine as postgresql-client); the Ubuntu base-image migration translated it to 'postgresql', which on Ubuntu is the full server metapackage. The sqlite3 CLI is likewise debug-only tooling, and the Kaleido platform always runs firefly against postgres. Dropping both shrinks the image and its CVE surface while keeping psql for debugging.
Debug-only utilities like psql; nothing in the final stage uses them (no HEALTHCHECK, no scripts). Builder stages install their own curl.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the
curl,jq,sqlite3, andpostgresqlapt packages in the final image with justpostgresql-client.Nothing in FireFly executes external database binaries — the postgres and sqlite3 plugins use in-process
database/sqldrivers (internal/database/postgres,internal/database/sqlite3), and migrations run via golang-migrate as a library (GetMigrationDriver), never by shelling out. Thepsqlclient was originally added purely as a debugging utility (73a4ef7, on Alpine aspostgresql-client); the Ubuntu base-image migration translated it topostgresql, which on Ubuntu is the metapackage that pulls in the entire PostgreSQL server. Thesqlite3CLI is likewise debug-only tooling, and the Kaleido platform always runs firefly-core against postgres.curlandjqare also debug-only in the final stage — no HEALTHCHECK or script uses them (builder stages install their own).Dropping the server package tree and the debug CLIs shrinks the image and removes a recurring source of CVE scan findings, while keeping
psqlavailable for debugging.