Provide/publish docker images based on debian:trixie?
- Dominant language
- Java
- Stars
- 14.1k
- Forks
- 3.8k
- Avg merge
- 2d 58m
- Merged PRs (30d)
- 233
Description
We've noticed that there are many base OS-level vulnerabilities reported (as per our Trivy scans) in the latest base Druid image and were wondering if it might make sense to consider moving up from `debian:12.5` to `debian:trixie`.
```
$ trivy image apache/druid:30.0.0
…
apache/druid:30.0.0 (debian 12.5)
Total: 19 (UNKNOWN: 0, LOW: 14, MEDIUM: 2, HIGH: 2, CRITICAL: 1)
```
```
$ trivy image debian:12.6
...
debian:12.6 (debian 12.6)
Total: 72 (UNKNOWN: 0, LOW: 57, MEDIUM: 13, HIGH: 1, CRITICAL: 1)
```
```
$ trivy image debian:trixie
...
debian:trixie (debian trixie/sid)
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
```
Contributor guide
Research direction
The issue names no repository files or tests. Start by locating the configuration that builds and publishes apache/druid:30.0.0, then compare its Debian base with debian:12.5 and debian:trixie using the reported Trivy scans. Done means providing the requested Debian trixie-based Docker image and verifying its published image and vulnerability results.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- debian, docker
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100