Skip to content

Conversation

@lukebakken
Copy link
Collaborator

@lukebakken lukebakken commented Dec 2, 2025

Fixes #768

The RabbitMQ management images now include the Rust-based
rabbitmqadmin v2 (rabbitmq/rabbitmqadmin-ng on GitHub, doc guide) CLI tool when possible. The deprecated Python version of rabbitmqadmin will no longer be available.

This change adds a two-stage build to Dockerfile-management.template:

  • Builder stage: Attempts to compile rabbitmqadmin-ng from source
    using Rust toolchain installed via rustup-init.sh. The build links
    against the custom OpenSSL installation using OPENSSL_DIR and
    RUSTFLAGS with proper rpath configuration.
  • Final stage: Copies the Rust binary if build succeeded.

The versions.sh script fetches the latest rabbitmqadmin-ng release
tag from the GitHub API and calculates SHA256 checksums for both the
source archive and Rust installer. These values are stored in
versions.json and templated into the generated management Dockerfiles.

@lukebakken lukebakken changed the title Add rabbitmqadmin-ng build stage to Ubuntu Dockerfiles Add rabbitmqadmin-ng build stage to Dockerfiles Dec 2, 2025
@lukebakken lukebakken force-pushed the lukebakken/gh-768-rabbitmqadmin-ng branch 2 times, most recently from da577d7 to 612343e Compare December 2, 2025 16:55
@lukebakken lukebakken self-assigned this Dec 2, 2025
@lukebakken lukebakken changed the title Add rabbitmqadmin-ng build stage to Dockerfiles Add rabbitmqadmin-ng build stage to Dockerfile-management.template Dec 2, 2025
@lukebakken lukebakken force-pushed the lukebakken/gh-768-rabbitmqadmin-ng branch 3 times, most recently from 432a7f1 to 75f8e3e Compare December 2, 2025 17:14
@lukebakken lukebakken changed the title Add rabbitmqadmin-ng build stage to Dockerfile-management.template Add Rust-based rabbitmqadmin-ng with Python fallback Dec 2, 2025
@lukebakken lukebakken force-pushed the lukebakken/gh-768-rabbitmqadmin-ng branch from 75f8e3e to e5aec78 Compare December 2, 2025 17:24
@lukebakken lukebakken marked this pull request as ready for review December 2, 2025 17:29
@lukebakken
Copy link
Collaborator Author

lukebakken commented Dec 2, 2025

From local testing:

rabbitmqadmin show overview
lrbakken@SEA-3LG5HVJUWJK ~/development/docker-library/rabbitmq (lukebakken/gh-768-rabbitmqadmin-ng =)
$ docker exec --interactive --tty rabbitmq /bin/bash
root@b2f805c7eec6:/# rabbitmqadmin show overview
┌───────────────────────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Overview                                                                                                                                                                 │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ key                                                               │ value                                                                                                │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Product name                                                      │ RabbitMQ                                                                                             │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Product version                                                   │ 4.2.1                                                                                                │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ RabbitMQ version                                                  │ 4.2.1                                                                                                │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Erlang version                                                    │ 27.3.4.6                                                                                             │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Erlang details                                                    │ Erlang/OTP 27 [erts-15.2.7.4] [source] [64-bit] [smp:12:12] [ds:12:12:10] [async-threads:1] [jit:ns] │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Connections (total)                                               │ 0                                                                                                    │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ AMQP 0-9-1 channels (total)                                       │ 0                                                                                                    │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Queues and streams (total)                                        │ 0                                                                                                    │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Consumers (total)                                                 │ 0                                                                                                    │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Messages (total)                                                  │ 0                                                                                                    │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Messages ready for delivery (total)                               │ 0                                                                                                    │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Messages delivered but unacknowledged by consumers (total)        │ 0                                                                                                    │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Publishing (ingress) rate (global)                                │                                                                                                      │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Publishing confirm rate (global)                                  │                                                                                                      │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Consumer delivery (egress) rate (global)                          │                                                                                                      │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Consumer delivery in automatic acknowledgement mode rate (global) │                                                                                                      │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Consumer acknowledgement rate (global)                            │                                                                                                      │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Unroutable messages: returned-to-publisher rate (global)          │                                                                                                      │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Unroutable messages: dropped rate (global)                        │                                                                                                      │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Cluster tags                                                      │                                                                                                      │
├───────────────────────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Node tags                                                         │                                                                                                      │
└───────────────────────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────────────────────────────────────────────┘
root@b2f805c7eec6:/# ldd /usr/local/bin/rabbitmqadmin
        linux-vdso.so.1 (0x00007ffdcb5d9000)
        libssl.so.3 => /opt/openssl/lib/libssl.so.3 (0x00007f5a398c9000)
        libcrypto.so.3 => /opt/openssl/lib/libcrypto.so.3 (0x00007f5a392a5000)
        libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f5a39275000)
        libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f5a3918c000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f5a38f7a000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f5a3a701000)

@tianon @yosifkit I don't have any way to test on an esoteric architecture. Are these built for pull requests? Would you mind directing me to the build logs / artifacts so I can test them out?

@lukebakken lukebakken marked this pull request as draft December 2, 2025 17:44
@lukebakken lukebakken force-pushed the lukebakken/gh-768-rabbitmqadmin-ng branch from ce7f657 to 6f0223b Compare December 2, 2025 17:50
@michaelklishin
Copy link
Collaborator

I'd leave the Python version behind entirely. It's no longer maintained.

Plus this tool is entirely optional. The OCI can be used without it.

@lukebakken lukebakken force-pushed the lukebakken/gh-768-rabbitmqadmin-ng branch 3 times, most recently from 171dafe to 64e0428 Compare December 2, 2025 18:51
@lukebakken lukebakken force-pushed the lukebakken/gh-768-rabbitmqadmin-ng branch 3 times, most recently from 33786ab to a70d772 Compare December 2, 2025 19:48
@lukebakken lukebakken marked this pull request as ready for review December 2, 2025 20:04
@lukebakken lukebakken force-pushed the lukebakken/gh-768-rabbitmqadmin-ng branch from a70d772 to 32daba6 Compare December 2, 2025 20:13
@lukebakken
Copy link
Collaborator Author

Everything is set for a review, thanks 😸

Copy link
Collaborator

@michaelklishin michaelklishin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would remove rabbitmqadmin v1, or rather, not drag it along.

It is no longer maintained besides truly exceptional issues like security vulnerabilities (which are unlikely to be reported for such a tool).

One of the goals of rabbitmqadmin v2 as a native binary was to avoid numerous [older] Python CVEs that plagued several RabbitMQ images due to the inclusion of rabbitmqadmin v1.

Finally, there are some breaking changes in rabbitmqadmin v2 but the users seem to be adapting to them without any complaints, and rabbitmqadmin v2 is so far ahead in terms of features and test coverage that it feels like shipping two different tools at this point.

rabbitmqadmin v2 is a nice-to-have in this image. If the Rust toolchain does not support a particular platform, well, it won't be available but everything else that this image offers will be.

@lukebakken lukebakken changed the title Add Rust-based rabbitmqadmin-ng with Python fallback Add Rust-based rabbitmqadmin-ng and remove Python Dec 3, 2025
The RabbitMQ management images now include the Rust-based
`rabbitmqadmin-ng` CLI tool when possible. The deprecated Python version
of `rabbitmqadmin` will no longer be available.

This change adds a two-stage build to `Dockerfile-management.template`:
- **Builder stage**: Attempts to compile `rabbitmqadmin-ng` from source
  using Rust toolchain installed via `rustup-init.sh`. The build links
  against the custom OpenSSL installation using `OPENSSL_DIR` and
  `RUSTFLAGS` with proper rpath configuration.
- **Final stage**: Copies the Rust binary if build succeeded.

The `versions.sh` script fetches the latest `rabbitmqadmin-ng` release
tag from the GitHub API and calculates SHA256 checksums for both the
source archive and Rust installer. These values are stored in
`versions.json` and templated into the generated management Dockerfiles.
@lukebakken lukebakken force-pushed the lukebakken/gh-768-rabbitmqadmin-ng branch from 32daba6 to 5f3f9c0 Compare December 3, 2025 20:45
@michaelklishin
Copy link
Collaborator

@yosifkit @tianon this PR should really have a review from one of you folks (or both!)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update Alpine-based rabbitmq images to fix SQLite CVE-2025-6965

2 participants