[Experiment] Switch runtime base to python:3.12-alpine (musl) to fix CVE-2026-5450

[dimittal]

Status: DRAFT — runtime smoke testing pending

This branch swaps the runtime base image from python:3.12-slim-trixie (glibc 2.41) to python:3.12-alpine (musl 1.2.5) to eliminate CVE-2026-5450 (glibc scanf %mc heap overflow, CVSS 9.8) and dramatically reduce the OS-level CVE surface.

Empirical comparison (jf docker scan against trialwyikk8 — same Xray engine as customer's entplus.jfrog.io)

Metric	Trixie v3 (current main)	Alpine (this branch)	Δ
CVE-2026-5450 (Critical, 9.8)	Present, Applicable, no fix	Gone	✅
Critical total	1	0	✅
High total	12	4	✅ −8
Medium total	18	13	✅ −5
Low total	50	0 (2 Unknown)	✅
Secrets (the 59 ignore-rule cluster)	59	59 — identical files/lines	same
Image size	365 MB	272 MB	-25%

The 4 remaining Highs are not net-new:

• CVE-2018-20225 (pip) — disputed CVE, already in our triage as a known false positive.
• CVE-2026-3805 x2 (curl/libcurl 8.17.0-r1 on Alpine 3.23) — fix exists upstream in 8.19.0-r0 (currently on Alpine edge); 3.23 backport pending. Same situation as Debian backports.
• CVE-2026-27135 (nghttp2-libs) — Xray Contextual Analysis marks Not Applicable.

Dockerfile deltas

Builder stage (python:3.12-bookworm → python:3.12-alpine):

• apt-get install build-essential libpq-dev gettext curl → apk add build-base postgresql-dev mariadb-dev libffi-dev openssl-dev libxml2-dev libxslt-dev pkgconfig gettext curl git cargo rust
• Rust install via apk add cargo rust (replaces curl+rustup approach; needed for cryptography source build when no musllinux wheel)

Runtime stage (python:3.12-slim-trixie → python:3.12-alpine):

• apt-get install libpq5 nginx procps curl → apk add libpq nginx bash tzdata musl-locales libstdc++ libgcc libxml2 libxslt lz4-libs mariadb-connector-c procps-ng curl file ca-certificates
• nginx.default deployed to /etc/nginx/http.d/default.conf instead of /etc/nginx/sites-available/default (Alpine convention)
• chown www-data:www-data /code → chown nginx:nginx /code (nginx package's user on Alpine)
• ENV PYTHONTHREADSTACKSIZE=8388608 set explicitly — musl's 80KB default segfaults Celery threadpool workers; this matches glibc's 8MB default

All existing scrub steps (RECORD, METADATA truncation, .pyi removal, sed replacements) ported as-is — they're plain find/sed/rm commands that work identically on BusyBox.

Smoke tests passed

• ✅ Build completes cleanly (4 iterations to add the right apk deps)
• ✅ 27 critical Python imports succeed (django, celery, cryptography, psycopg2, mysqlclient, pymysql, google.auth, google.cloud, kubernetes, msal, azure.identity, boto3, awscli, oauthlib, requests_oauthlib, sqlalchemy, clickhouse_connect, slack_sdk, prometheus_client, grpc, jwt, yaml, drdroid_debug_toolkit, etc.)
• ✅ nginx -t passes
• ✅ kubectl v1.36.0 installs and runs
• ✅ bash and otterize CLI install correctly
• ✅ Xray secrets scan: 59 (identical to trixie v3 — no new false positives)

NOT YET TESTED — required before merging out of draft

• End-to-end agent boot under Kind (gunicorn + Celery worker + Celery beat + nginx orchestration)
• Connector calls against live targets:
  • Grafana / Loki
  • Datadog
  • Kubernetes (in-cluster + EKS + GKE)
  • AWS (boto3 paths)
  • Azure / AKS (managed-identity)
  • GCP / GKE
  • ArgoCD
  • PostgreSQL / MySQL / ClickHouse connectors
• Helm chart deployment in Kind
• Celery worker stability under load (musl thread stack sizing — PYTHONTHREADSTACKSIZE set but unverified)
• DNS resolver edge cases (musl's getaddrinfo is stricter than glibc's; some .local / mDNS / NIS edge cases differ)
• Django i18n / locale handling (musl-locales installed but locale catalogs not exercised)
• Image runs without permission errors (chown changed from www-data to nginx — verify Celery start scripts work under nginx user)

How to test

Local Kind smoke test (per existing deploy_local.sh):

git checkout experiment/alpine-base
./deploy_local.sh <DRD_CLOUD_API_TOKEN>

Then exercise each connector via the dashboard / CLI and verify the agent registers cleanly with drcloud.

🤖 Generated with Claude Code