Repository navigation
build(docker): Use Debian 13 (trixie) for the build and runtime images - #813
Merged
Merged
Conversation
oioki
marked this pull request as ready for review
October 8, 2026 12:44
evanh
approved these changes
Oct 8, 2026
Move the runtime image from debian:bookworm-slim to debian:trixie-slim, and the build image from the mirrored rust:1.96.1-bookworm to the mirrored rust:1.96.1-trixie so the binary links against the same OpenSSL and glibc it runs with. This drops four of the five critical CVEs in the image and puts it on the same Debian release as the distroless image that comes next. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
oioki
force-pushed
the
build/docker-trixie
branch
from
October 13, 2026 16:50
3626356 to
076008e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switch the runtime image from
debian:bookworm-slim(Debian 12) todebian:trixie-slim(Debian 13), and the build image from the mirroredrust:1.96.1-bookwormto the mirroredrust:1.96.1-trixie(added in getsentry/image-mirror#38). Unlike vroom's static Go binary, taskbroker links against the system OpenSSL, zlib and glibc, so the build and runtime stages move together.trivy on the built images (same source in both, built locally):
The criticals that go away are in
libaom3,libsqlite3-0/libsqlite3-devandzlib1g. The one left is inlinux-libc-dev, which comes in with the-devpackages the runtime stage installs. Most of the remaining findings come from those packages too; trimming them is a separate change.Both images start the same way locally: SQLite opens, the gRPC server listens, and librdkafka initializes before failing to reach a broker.
This also puts the image on the same Debian release as the distroless variant that comes next, so going from Debian 12 slim to
static-debian13happens in two smaller steps. Same change in vroom: getsentry/vroom#714.Tested the amd64 image on the Sentry devserver, running both taskbrokers on it: regular tasks, retries and deadletters went through, and profiles sent through ingestion were processed by the raw-mode broker. Also ran it on a self-hosted instance with profiles ingested end to end.
Refs SEC-1089