Skip to content

Support alpine images #78

Closed
Closed
@bdun1013

Description

@bdun1013

The official Postgres images support an alpine base image build: https://github.com/docker-library/postgres/tree/master/16/alpine3.18

Alpine is much smaller than debian and has many fewer vulnerabilities

Activity

sxd

sxd commented on Feb 22, 2024

@sxd
Member

Hi @bdun1013

Do you have some research that actually show that alpine has fewer vulnerabilities? and in any case, we already look for security issues on the images now.

Regards,

self-assigned this
on Feb 22, 2024
gazab

gazab commented on Feb 27, 2024

@gazab

Here's output from CVE scanning both Debian and Alpine based Postgres images with Trivy (https://github.com/aquasecurity/trivy)

❯ podman run docker.io/aquasec/trivy image postgres:16.2-bullseye

postgres:16.2-bullseye (debian 11.9)
====================================
Total: 195 (UNKNOWN: 12, LOW: 121, MEDIUM: 32, HIGH: 28, CRITICAL: 2)

❯ podman run docker.io/aquasec/trivy image postgres:16.2-alpine

postgres:16.2-alpine (alpine 3.19.1)
====================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

We would also like Alpine based images very very much.

onedr0p

onedr0p commented on Feb 27, 2024

@onedr0p

Even more if you scan it against the official cloudnative-pg image...

ghcr.io/cloudnative-pg/postgresql:16.2-6 (debian 11.9)
======================================================
Total: 273 (UNKNOWN: 12, LOW: 143, MEDIUM: 55, HIGH: 57, CRITICAL: 6)
sxd

sxd commented on Mar 28, 2025

@sxd
Member

Those images are out of support and aren't supposed to be used anymore, closing

mungo312

mungo312 commented on May 8, 2025

@mungo312

@sxd Where did you see the images are out of support ? I can't find any hint about this. There are up to date images generated on the upstream based on alpine. Would be really great if we could use them with cnpg.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

    Development

    Participants

    @onedr0p@gazab@sxd@mungo312@bdun1013

    Issue actions

      Support alpine images · Issue #78 · cloudnative-pg/postgres-containers