fix(bookworm): drop unusable C headers to clear linux-libc-dev CVEs - #502
Merged
Conversation
The Perl base image ships a C header toolchain (libc6-dev, linux-libc-dev, libssl-dev, zlib1g-dev, libcrypt-dev) so that XS modules can be compiled inside the container. Our runtime image has no C compiler, so those headers can never be used -- but Trivy keeps reporting kernel and OpenSSL CVEs against them (e.g. CVE-2026-53138 on linux-libc-dev 6.1.176-1). The fixed versions will never arrive: the base tag is pinned to Perl 5.38, which is end-of-life upstream, so no rebuilt tag is published. Removing the packages is therefore the only way to clear these findings, and it costs nothing because they were already dead weight (~36 MB). Alongside that: - libarchive-dev -> libarchive13. Only the runtime library was ever needed; no cpanfile requires the headers. The -dev package has been in here since the first bookworm Dockerfile without a consumer. - Drop python3-dev, which would pull libc6-dev and linux-libc-dev straight back into the full image and is equally unusable without a compiler. The runtime libraries (libc6, libssl3, zlib1g, libarchive13) stay installed. The deprecated CPAN_PKGS/PIP_PKGS runtime install paths in entry.sh could not build C extensions before this change either, for lack of a compiler. Bullseye is left untouched on purpose. Verified by replaying the patched base-cpan stage against both bookworm base images: no apt errors, no -dev packages left, and perl, IO::Socket::SSL, sqlite3, svn and mysql still work (useithreads=define on the threaded image). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N3oE4DmgZNsmXsTtCP4Z45
CPAN Build Report
|
CPAN Build Report
|
CPAN Build Report
|
CPAN Build Report
|
CPAN Build Report
|
CPAN Build Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Trivy reports several CVEs against
linux-libc-devin the bookworm images, e.g.The package does not come from this repository. It is inherited from the
upstream Perl base image, which ships a C header toolchain so that XS modules
can be compiled inside the container:
A fixed base tag will never arrive: the tag is pinned to Perl 5.38, which is
end-of-life upstream, so no rebuilt image is published.
The key observation is that the runtime image contains no C compiler —
cc,gccandg++are all absent, onlymakeis present. The headers cantherefore never be used for anything. They are roughly 36 MB of dead weight
that drags kernel and OpenSSL CVEs into every scan.
linux-libc-devcontainsonly
.hfiles; the CVE concerns the host kernel, never the container.Change
Applied to
Dockerfile-bookwormandDockerfile-threaded-bookworm:base-cpanstage:linux-libc-dev,libc6-dev,libcrypt-dev,libssl-dev,zlib1g-dev.Their auto-installed companions (
libc-dev-bin,libnsl-dev,libtirpc-dev,rpcsvc-proto) are taken by theautoremovethat alreadyfollows. The matching runtime libraries (
libc6,libssl3,zlib1g,libarchive13) stay installed.libarchive-dev→libarchive13. Only the runtime library was everneeded; no cpanfile requires the headers. The
-devpackage has been inhere since the first bookworm Dockerfile without a consumer.
python3-dev. It would pulllibc6-devand thuslinux-libc-devstraight back into the full image, and is equally unusable without a
compiler.
The deprecated
CPAN_PKGS/PIP_PKGSruntime install paths inentry.shcould not build C extensions before this change either, for lack of a
compiler — pure-Perl and pure-Python packages are unaffected.
Scope
Bullseye is deliberately left untouched.
Worth noting separately: bullseye builds are currently broken for an unrelated,
pre-existing reason —
deb.debian.org/debian-securityreturns 404 forlibperl5.32,avahi-daemonandlibavahi-common-datasince Debian 11 movedto the archive.
Verification
The patched
base-cpanstage was replayed against both real base images(
perl:5.38.5-slim-bookwormandperl:5.38.5-slim-threaded-bookworm):-devpackagesuseithreadsdefineAn earlier draft that also listed
rpcsvc-protowas dropped: that package doesnot exist in bullseye and
apt-get purgeaborts hard on an unknown name.🤖 Generated with Claude Code
https://claude.ai/code/session_01N3oE4DmgZNsmXsTtCP4Z45