Skip to content

Slightly more secure and much smaller docker image#855

Open
c2h5oh wants to merge 1 commit intososedoff:mainfrom
c2h5oh:master
Open

Slightly more secure and much smaller docker image#855
c2h5oh wants to merge 1 commit intososedoff:mainfrom
c2h5oh:master

Conversation

@c2h5oh
Copy link
Copy Markdown

@c2h5oh c2h5oh commented May 5, 2026

Uses Google distroless Debian image as base of the final image ( see https://github.com/googlecontainertools/distroless ).

The new image:

  • is more secure, because it's been stripped off anything that it could have been leaving much smaller attack surface
  • is rootless
  • doesn't constantly trigger security scanners - a CVE in anything included in the image does that and this one contains next to nothing
  • is almost 85% smaller (10.5 vs 65 MB)

Motivation: security scanner flagging 3 CVEs in unused parts of the image + security team giving us 3 days to either fix it or retire pgweb..

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant