jayakasadev opened a new pull request, #68351:
URL: https://github.com/apache/doris/pull/68351
### What problem does this PR solve?
Issue Number: close #xxx
Related PR: #xxx
Problem Summary:
`trivy image apache/doris:fe-4.1.4` reports 59 CRITICAL findings, and 54 of
them
are Linux kernel CVEs attributed to two packages that the runtime image has
no
reason to carry:
```
linux-libc-dev 5.15.0-164.174 27 CRITICAL (6 with no fixed version)
linux-tools-common 5.15.0-164.174 27 CRITICAL (6 with no fixed version)
```
The same 54 appear in be-4.1.4 (62 total) and ms-4.1.4 (57 total).
Root cause in code: three entries of the base image's apt list pull them in
transitively. Verified by `apt-get install -s` on ubuntu:22.04:
- `linux-tools-realtime` -> `linux-tools-common`
- `libperl-dev` -> `linux-libc-dev` + `libc6-dev`
- `python2-dev` -> `linux-libc-dev` + `libc6-dev`
These packages are built from the `linux` and `glibc` source packages, so
Ubuntu
maps every kernel CVE onto them, but they ship only UAPI headers and perf
wrapper
scripts. The vulnerable code runs in the host kernel, which a container image
cannot patch or worsen, so the findings are not actionable inside the image.
Six
of them have no fixed version at all, so an `apt upgrade` can never clear the
count - only removing the packages does.
What the removed packages provided:
- `linux-tools-realtime` existed solely for the `/usr/bin/perf` symlink, and
`bpfcc-tools` + `linux-headers-realtime` for BCC. Both are
host-kernel-coupled:
they need `--privileged` and a kernel matching the headers baked into the
image
to work at all, so a debug sidecar sharing the target pod's namespaces is
the
correct way to run them.
- `libperl-dev` and `python2-dev` had no runtime consumer. `google-pprof` is
a
perl script and runs on the base perl interpreter; verified `pprof
--version`
still works in the rebuilt image. python2 is EOL and unused.
End-to-end result, building the base image before and after (linux/arm64):
- before: 54 CRITICAL from the two kernel packages
- after: 0 CRITICAL from them; the rebuilt base image reports 2 CRITICAL,
both
CVE-2025-68121 in the Go stdlib of the `doris-debug`/`dorisctl` binaries
copied
from `apache/doris:debug-latest`, which is a separate image outside this
repo
Verified the surviving tooling in the rebuilt image: `pprof`, `gdb`, `mysql`
client, JDK 17, and the `dorisctl`/`doris-debug` binaries, plus that no
`linux-libc-dev`/`linux-tools-common`/`libc6-dev` remain installed.
The base image tag moves to `base-6.1` and the fe/be/ms Dockerfiles are
updated
in lockstep, matching how #59292 moved base-5.0 -> base-6.0.
### Release note
Removed kernel-header and -dev packages (`linux-tools-realtime`,
`bpfcc-tools`,
`linux-headers-realtime`, `libperl-dev`, `python2-dev`) from the Doris
runtime
base image, eliminating 54 non-actionable CRITICAL CVE findings per image.
`perf`
and the BCC tools are no longer present; run them from a debug sidecar
sharing
the target container's namespaces instead. `pprof`, `gdb`, and `strace` are
unaffected.
### Check List (For Author)
- Test: Manual test - built `Dockerfile_base` for linux/arm64 before and
after,
scanned both with trivy to confirm the 54 kernel-package criticals are
gone,
and smoke-tested `pprof`, `gdb`, `mysql`, JDK 17, and the debug binaries
in the
rebuilt image. Also confirmed the transitive pull-in attribution with
`apt-get install -s` per package. No regression test applies: this repo
has no
CI that builds the runtime images.
- Behavior changed: Yes - `perf` and the BCC tools are no longer shipped in
the
runtime image, for the reasons above.
- Does this need documentation: No
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
