Repository navigation
fix(profiler): rebuild images on patched OS packages and go1.26.10 - #155
Merged
Merged
Conversation
- Build the agent with go1.26.10 in every Dockerfile. - Alpine images (python, perf, jvm): run apk upgrade before apk add, so base packages such as openssl pick up their patched releases instead of staying at the base image's build-time level. - python: move to python:3.14.10-alpine and uninstall pip after installing austin. Nothing runs pip at profile time, and its vendored setuptools and urllib3 carried known CVEs. - ruby: move the runtime to minideb:trixie with apt-get upgrade. bookworm leaves zlib CVE-2023-45853 unfixed; rbspy and the agent, built on bookworm, run unchanged on trixie's newer glibc.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Go version from 1.26.5 to 1.26.10 across several Dockerfiles and test scripts, and introduces package upgrades to address vulnerabilities. Notably, it uninstalls pip in the Python image and switches the Ruby base image to Debian trixie. The review feedback suggests avoiding the use of the testing distribution (trixie) in production due to instability risks, recommending instead to stick to bookworm and handle the target CVE via an ignore list or backporting. Additionally, it is recommended to use the --no-cache-dir flag during pip installation to optimize the Python image size.
RamanKharchee
approved these changes
Oct 29, 2026
blue4209211
approved these changes
Oct 29, 2026
Merged
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The profiler images ship OS packages and Python tooling with known CVEs that NVD scores 8.0 or higher: OpenSSL in the python image, perl and zlib in the ruby image. This rebuilds every image on patched packages and Go 1.26.10. The python and ruby images go from 4 and 16 fixable 8.0+ findings to 0, and profiling behaviour is unchanged.
How to verify
trivy imageon the new python and ruby tags reports no NVD 8.0+ findings with a fix available.Risks
Type of change
Test plan and detail
GOTOOLCHAIN=localkept).apk upgradebeforeapk addon the alpine images. python base3.14.0-alpine->3.14.10-alpine. ruby runtimeminideb:bookworm->minideb:trixiewithapt-get upgrade.Local e2e: built each image (linux/arm64) and profiled live processes: py-spy dump/record and austin -> mojo2austin -> flamegraph on python; rbspy snapshot/record with the agent's flags on Ruby 3.3.6 (old and new images behave the same); bcc tools, perf 6.19.14 and async-profiler libs present in bpf/perf/jvm.
test/e2e/python-austin.sh,python-austin-multi-pid.shandgo-pprof.shpass against the rebuilt images.Scans, NVD 8.0+ (fixable / no fix): bpf 0, jvm 0, perf 0 before and after; python 4/0 -> 0/0; ruby 16/9 -> 0/4.
Not caused by this PR, seen while testing: rbspy 0.27.0 rejects Ruby 3.3.13 as unsupported, and panics on its progress display without a TTY unless
--silentis passed.Checklist
go build ./...andgo test ./...pass locally (Go code unchanged; images compile the agent on 1.26.10)