From cfa7e9666e1296db7fb47518d76fa72b2c1ec5f9 Mon Sep 17 00:00:00 2001 From: Sujeito Operator Date: Tue, 11 Aug 2026 06:33:12 +0200 Subject: [PATCH 1/3] Dockerfile: pin the uv builder image COPY --from= here names an external image, not an earlier stage, so :latest leaves the tool that builds the wheel floating between builds. --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 7e42b62d3..9e9ee613a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ FROM python:3.13-bookworm AS builder -COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:0.12.3 /uv /uvx /bin/ WORKDIR /build From b00f9c4888e4e47e64ed8ac5ac1a3163af06941a Mon Sep 17 00:00:00 2001 From: Sujeito Operator Date: Tue, 11 Aug 2026 06:33:13 +0200 Subject: [PATCH 2/3] Dockerfile: remove the apt lists from the final image apt-get clean empties /var/cache/apt/archives (the downloaded .debs). The indices apt-get update fetched live in /var/lib/apt/lists and survive it, so they ship in the image. --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 9e9ee613a..37f79b851 100644 --- a/Dockerfile +++ b/Dockerfile @@ -34,7 +34,8 @@ ENV PATH=/opt/exabgp/bin:$PATH # install deps RUN apt-get update \ && apt-get install -y iproute2 dumb-init \ - && apt-get clean + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* # Add ExaBGP RUN useradd -r exa \ From f2d357603b37808a1cb217d23d2e521949dcc13f Mon Sep 17 00:00:00 2001 From: Operator Date: Wed, 12 Aug 2026 06:34:10 +0000 Subject: [PATCH 3/3] Drop the uv pin; keep only the apt lists removal Per @thomas-mangin: uv is a build tool whose behaviour should not change between releases, and the project does not track its security advisories, so pinning it buys nothing here and costs a bump to maintain. Leaves one change: 'rm -rf /var/lib/apt/lists/*' in the same RUN as apt-get install, so the package lists do not ship inside the image. --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 37f79b851..94a2b141d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ FROM python:3.13-bookworm AS builder -COPY --from=ghcr.io/astral-sh/uv:0.12.3 /uv /uvx /bin/ +COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/ WORKDIR /build