From 32ad0074b257c72a7c77faf3b24121b3c86c4825 Mon Sep 17 00:00:00 2001 From: mayankpande88 Date: Thu, 29 Oct 2026 14:07:43 +0530 Subject: [PATCH 1/2] fix(profiler): rebuild images on patched OS packages and go1.26.10 - Build the agent with go1.26.10 in every Dockerfile. - Alpine images (python, perf, jvm): run apk upgrade before apk add, so base packages such as openssl pick up their patched releases instead of staying at the base image's build-time level. - python: move to python:3.14.10-alpine and uninstall pip after installing austin. Nothing runs pip at profile time, and its vendored setuptools and urllib3 carried known CVEs. - ruby: move the runtime to minideb:trixie with apt-get upgrade. bookworm leaves zlib CVE-2023-45853 unfixed; rbspy and the agent, built on bookworm, run unchanged on trixie's newer glibc. --- docker/bpf/Dockerfile | 2 +- docker/dummy/Dockerfile | 2 +- docker/jvm/Dockerfile | 2 +- docker/jvm/alpine/Dockerfile | 3 ++- docker/perf/Dockerfile | 5 +++-- docker/python/Dockerfile | 14 ++++++++++---- docker/ruby/Dockerfile | 7 +++++-- test/e2e/go-pprof.sh | 2 +- 8 files changed, 24 insertions(+), 13 deletions(-) diff --git a/docker/bpf/Dockerfile b/docker/bpf/Dockerfile index 3f977a8..2d9dfb2 100644 --- a/docker/bpf/Dockerfile +++ b/docker/bpf/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.5-alpine AS agentbuild +FROM golang:1.26.10-alpine AS agentbuild ENV GOTOOLCHAIN=local WORKDIR /go/src/github.com/nudgebee/application-profiler COPY . /go/src/github.com/nudgebee/application-profiler diff --git a/docker/dummy/Dockerfile b/docker/dummy/Dockerfile index ba56a3b..8547b84 100644 --- a/docker/dummy/Dockerfile +++ b/docker/dummy/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.5-alpine AS agentbuild +FROM golang:1.26.10-alpine AS agentbuild ENV GOTOOLCHAIN=local WORKDIR /go/src/github.com/nudgebee/application-profiler COPY . /go/src/github.com/nudgebee/application-profiler diff --git a/docker/jvm/Dockerfile b/docker/jvm/Dockerfile index 3281aa5..d908305 100644 --- a/docker/jvm/Dockerfile +++ b/docker/jvm/Dockerfile @@ -1,5 +1,5 @@ ARG JAVA_VERSION_TAG=21 -FROM golang:1.26.5-bookworm AS agentbuild +FROM golang:1.26.10-bookworm AS agentbuild ENV GOTOOLCHAIN=local WORKDIR /go/src/github.com/nudgebee/application-profiler COPY . /go/src/github.com/nudgebee/application-profiler diff --git a/docker/jvm/alpine/Dockerfile b/docker/jvm/alpine/Dockerfile index f83c2f2..d9d06f2 100644 --- a/docker/jvm/alpine/Dockerfile +++ b/docker/jvm/alpine/Dockerfile @@ -1,6 +1,6 @@ ARG JAVA_VERSION_TAG=21 ARG ASYNCP_VERSION=2.9 -FROM golang:1.26.5-alpine AS agentbuild +FROM golang:1.26.10-alpine AS agentbuild ENV GOTOOLCHAIN=local WORKDIR /go/src/github.com/nudgebee/application-profiler COPY . /go/src/github.com/nudgebee/application-profiler @@ -61,6 +61,7 @@ RUN apk add --no-cache curl g++ git linux-headers make tar wget \ FROM alpine:3.23.4 RUN mkdir -p /app/async-profiler/build \ + && apk upgrade --no-cache \ && apk add --no-cache procps coreutils COPY --from=agentbuild /go/bin/agent /app COPY --from=agentbuild /go/src/github.com/nudgebee/application-profiler/contrib/jvm/profiler.sh /app/async-profiler diff --git a/docker/perf/Dockerfile b/docker/perf/Dockerfile index dcb0223..4d8b051 100644 --- a/docker/perf/Dockerfile +++ b/docker/perf/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.5-bookworm AS agentbuild +FROM golang:1.26.10-bookworm AS agentbuild ENV GOTOOLCHAIN=local WORKDIR /go/src/github.com/nudgebee/application-profiler COPY . /go/src/github.com/nudgebee/application-profiler @@ -11,7 +11,8 @@ RUN apk add --no-cache git \ && git clone https://github.com/brendangregg/FlameGraph FROM alpine:3.23.4 -RUN apk add --no-cache perf perl procps \ +RUN apk upgrade --no-cache \ + && apk add --no-cache perf perl procps \ && mkdir -p /app/FlameGraph COPY --from=agentbuild /go/bin/agent /app/agent RUN mv /usr/bin/perf /app/perf diff --git a/docker/python/Dockerfile b/docker/python/Dockerfile index fbf27d9..97c68cf 100644 --- a/docker/python/Dockerfile +++ b/docker/python/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.5-alpine AS agentbuild +FROM golang:1.26.10-alpine AS agentbuild ENV GOTOOLCHAIN=local WORKDIR /go/src/github.com/nudgebee/application-profiler COPY . /go/src/github.com/nudgebee/application-profiler @@ -16,8 +16,11 @@ RUN pip3 install py-spy==0.4.2 \ && apt-get update && apt-get install -y git \ && git clone https://github.com/brendangregg/FlameGraph -FROM python:3.14.0-alpine -RUN apk add --update --no-cache perl procps strace \ +FROM python:3.14.10-alpine +# apk upgrade first: apk add only updates the packages it names, so base +# packages such as openssl would otherwise stay at the image's build-time level. +RUN apk upgrade --no-cache \ + && apk add --no-cache perl procps strace \ && mkdir -p /app/FlameGraph COPY --from=pyspybuild /FlameGraph /app/FlameGraph COPY --from=agentbuild /go/bin/agent /app/agent @@ -27,7 +30,10 @@ COPY --from=agentbuild /go/src/github.com/nudgebee/application-profiler/contrib/ # target is reported as "not a Python process". It only writes the binary MOJO # format, so austin-python comes along for mojo2austin, which converts it back # to the text format the raw artefact and flamegraph.pl are built around. -RUN pip3 install austin-dist==4.0.0 austin-python==1.7.1 +# pip is dropped afterwards: nothing runs it at profile time, and its vendored +# copies of setuptools and urllib3 carry CVEs that ship with the image otherwise. +RUN pip3 install austin-dist==4.0.0 austin-python==1.7.1 \ + && pip3 uninstall -y pip RUN chmod +x /app/get-ps-command.sh CMD [ "/app/agent" ] \ No newline at end of file diff --git a/docker/ruby/Dockerfile b/docker/ruby/Dockerfile index 7abb7f9..5ef039f 100644 --- a/docker/ruby/Dockerfile +++ b/docker/ruby/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.5-bookworm AS agentbuild +FROM golang:1.26.10-bookworm AS agentbuild ENV GOTOOLCHAIN=local WORKDIR /go/src/github.com/nudgebee/application-profiler COPY . /go/src/github.com/nudgebee/application-profiler @@ -13,8 +13,11 @@ RUN git clone https://github.com/brendangregg/FlameGraph \ WORKDIR /rbspy RUN cargo build --release -FROM bitnami/minideb:bookworm +# trixie, not bookworm: bookworm leaves zlib CVE-2023-45853 unfixed. rbspy and +# the agent are built against bookworm's older glibc, which runs on trixie's. +FROM bitnami/minideb:trixie RUN apt-get update \ + && apt-get upgrade -y \ && apt-get install -y procps strace \ && apt-get clean \ && mkdir -p /app/FlameGraph diff --git a/test/e2e/go-pprof.sh b/test/e2e/go-pprof.sh index b7af884..f61402f 100755 --- a/test/e2e/go-pprof.sh +++ b/test/e2e/go-pprof.sh @@ -61,7 +61,7 @@ func main() { } GO cat >"$work/Dockerfile" <<'DOCKERFILE' -FROM golang:1.26.5-alpine AS build +FROM golang:1.26.10-alpine AS build WORKDIR /src COPY main.go . RUN go mod init example.com/server && CGO_ENABLED=0 go build -o /server . From aca608c3666836ea72c0cab232dec481f917892b Mon Sep 17 00:00:00 2001 From: mayankpande88 Date: Thu, 29 Oct 2026 14:29:21 +0530 Subject: [PATCH 2/2] fix(profiler): skip the pip cache when installing austin --- docker/python/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/python/Dockerfile b/docker/python/Dockerfile index 97c68cf..e1cd0cc 100644 --- a/docker/python/Dockerfile +++ b/docker/python/Dockerfile @@ -32,7 +32,7 @@ COPY --from=agentbuild /go/src/github.com/nudgebee/application-profiler/contrib/ # to the text format the raw artefact and flamegraph.pl are built around. # pip is dropped afterwards: nothing runs it at profile time, and its vendored # copies of setuptools and urllib3 carry CVEs that ship with the image otherwise. -RUN pip3 install austin-dist==4.0.0 austin-python==1.7.1 \ +RUN pip3 install --no-cache-dir austin-dist==4.0.0 austin-python==1.7.1 \ && pip3 uninstall -y pip RUN chmod +x /app/get-ps-command.sh