[Experiment] Switch runtime base to python:3.12-alpine (musl) to fix CVE-2026-5450

Dockerfile

@@ -1,14 +1,22 @@
-FROM python:3.12-bookworm AS builder
-
-RUN apt-get update \
-  && apt-get upgrade -y \
-  && apt-get install -y build-essential libpq-dev gettext curl \
-  && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \
-  && rm -rf /var/lib/apt/lists/*
-
-# Install Rust for building dependencies
-ENV PATH="/root/.cargo/bin:${PATH}"
-RUN curl https://sh.rustup.rs -sSf | sh -s -- -y
+FROM python:3.12-alpine AS builder
+
+# Build deps for native Python wheels (cryptography → libffi+openssl+rust;
+# psycopg2 → postgresql-dev; lxml → libxml2-dev+libxslt-dev; etc.). Cargo+rust
+# are needed by `cryptography` when no musllinux wheel is available.
+RUN apk add --no-cache \
+    build-base \
+    postgresql-dev \
+    mariadb-dev \
+    libffi-dev \
+    openssl-dev \
+    libxml2-dev \
+    libxslt-dev \
+    pkgconfig \
+    gettext \
+    curl \
+    git \
+    cargo \
+    rust
 
 WORKDIR /build
 
@@ -87,32 +95,51 @@ RUN rm -rf /build/deps/allauth /build/deps/allauth-*.dist-info \
          /build/deps/sqlalchemy/dialects/mssql/pyodbc.py
 
 # ---- Runtime stage ----
-FROM python:3.12-slim-trixie
-
-RUN apt-get update \
-  && apt-get upgrade -y \
-  && apt-get install -y --no-install-recommends \
-  libpq5 \
-  nginx \
-  procps \
-  curl \
+FROM python:3.12-alpine
+
+# Runtime deps. Notes:
+#   - libpq: PostgreSQL client lib (psycopg2 needs at runtime)
+#   - nginx: reverse proxy in front of gunicorn
+#   - bash: scripts/start-*.sh use /bin/bash
+#   - tzdata: Django timezone-aware datetime + APScheduler need /usr/share/zoneinfo
+#   - musl-locales: Django i18n / gettext locale lookups
+#   - libstdc++ + libgcc: required for some compiled wheels at runtime
+#   - file: used during otterize install (mime-detection of the tarball)
+RUN apk add --no-cache \
+    libpq \
+    nginx \
+    bash \
+    tzdata \
+    musl-locales \
+    libstdc++ \
+    libgcc \
+    libxml2 \
+    libxslt \
+    lz4-libs \
+    mariadb-connector-c \
+    procps-ng \
+    curl \
+    file \
+    ca-certificates \
+  && update-ca-certificates \
   # Install kubectl
-  && ARCH=$(dpkg --print-architecture) \
+  && ARCH=$(uname -m) \
+  && case "$ARCH" in x86_64) ARCH=amd64 ;; aarch64) ARCH=arm64 ;; esac \
   && curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl" \
   && install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl \
   && rm kubectl \
   # Install Otterize CLI (optional - skip if download fails)
   && (curl -LJO https://get.otterize.com/otterize-cli/v2.0.3/otterize_linux_x86_64.tar.gz && \
-  file otterize_linux_x86_64.tar.gz | grep -q "gzip compressed" && \
-  tar xf otterize_linux_x86_64.tar.gz && \
-  install -o root -g root -m 0755 otterize /usr/local/bin/otterize && \
-  rm otterize_linux_x86_64.tar.gz) || echo "Otterize CLI installation skipped" \
-  # Clean up
-  && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \
-  && rm -rf /var/lib/apt/lists/*
-
-COPY nginx.default /etc/nginx/sites-available/default
-RUN ln -sf /dev/stdout /var/log/nginx/access.log \
+      file otterize_linux_x86_64.tar.gz | grep -q "gzip compressed" && \
+      tar xf otterize_linux_x86_64.tar.gz && \
+      install -o root -g root -m 0755 otterize /usr/local/bin/otterize && \
+      rm otterize_linux_x86_64.tar.gz) || echo "Otterize CLI installation skipped"
+
+# nginx on Alpine reads from /etc/nginx/http.d/*.conf, not /etc/nginx/sites-available/.
+# Drop the default config that ships in the package and supply ours.
+COPY nginx.default /etc/nginx/http.d/default.conf
+RUN rm -f /etc/nginx/http.d/default.conf.dpkg-* /etc/nginx/conf.d/default.conf 2>/dev/null || true \
+  && ln -sf /dev/stdout /var/log/nginx/access.log \
   && ln -sf /dev/stderr /var/log/nginx/error.log
 
 # Upgrade the base image's bundled pip to a version without known CVEs
@@ -129,6 +156,9 @@ ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
 ENV PYTHONPATH="/code/deps:${PYTHONPATH}"
 ENV PATH="/code/deps/bin:${PATH}"
+# musl's default thread stack is 80KB which segfaults Celery workers /
+# threadpool-heavy code that assumes glibc's 8MB default. Bump explicitly.
+ENV PYTHONTHREADSTACKSIZE=8388608
 
 # VCS metadata
 ARG COMMIT_HASH=unknown
@@ -142,7 +172,7 @@ COPY --from=builder /build/deps /code/deps
 
 # Copy project
 COPY . /code
-RUN chown -R www-data:www-data /code
+RUN chown -R nginx:nginx /code
 
 COPY scripts/start-celery-worker.sh .
 RUN sed -i 's/\r$//g' start-celery-worker.sh
@@ -154,4 +184,4 @@ RUN chmod +x start-celery-beat.sh
 
 
 EXPOSE 8080
-STOPSIGNAL SIGTERM
+STOPSIGNAL SIGTERM

packaged-helm/index.yaml

@@ -2,21 +2,21 @@ apiVersion: v1
 entries:
   drd-vpc-agent:
   - apiVersion: v2
-    created: "2025-11-12T19:55:48.724712+05:30"
+    created: "2026-04-28T12:40:24.634226+05:30"
     dependencies:
     - name: celery-beat
       repository: file://charts/celery_beat
-      version: 0.1.0
+      version: 0.1.2
     - name: celery-worker
       repository: file://charts/celery_worker
-      version: 0.1.0
+      version: 0.1.2
     - name: redis
       repository: file://charts/redis
-      version: 0.1.0
+      version: 0.1.2
     description: Celery-only deployment
-    digest: bc545d579f38a3bb5058bea91ee30f26ce83fb93ed52efd88dca6378140a151f
+    digest: f79f65271dd804d2b38ad931b2ab8b09aa81581fdb2cf57e2c887395f8dcb362
     name: drd-vpc-agent
     urls:
-    - https://drdroidlab.github.io/drd-vpc-agent/packaged-helm/drd-vpc-agent-0.1.0.tgz
-    version: 0.1.0
-generated: "2025-11-12T19:55:48.72348+05:30"
+    - https://drdroidlab.github.io/drd-vpc-agent/packaged-helm/drd-vpc-agent-0.1.2.tgz
+    version: 0.1.2
+generated: "2026-04-28T12:40:24.633775+05:30"