From 06e8291896e262f44bfb95d336b5eb8899e39852 Mon Sep 17 00:00:00 2001 From: npeter83 Date: Wed, 14 Oct 2026 20:51:07 +0200 Subject: [PATCH] build(image): rebuild the apt-get upgrade layer when APT_REFRESH changes A build cache kept the upgrade layer for as long as nothing above it changed, so a publish shipped curl and librsvg a release behind fixes already in the Debian archive (the CVE gate refused it). The release build passes the day; empty, the default for a self-hosted build, leaves the cache alone. --- Dockerfile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index b04e23be..31542cf6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -55,8 +55,14 @@ RUN adduser --disabled-password --gecos "" appuser \ # token, else only storyboards are offered). yt-dlp auto-detects deno on PATH. # `apt-get upgrade`: the base image is a snapshot, and the Debian security fixes released since it # was cut are only in the archive — the first Trivy scan found one (pcre2) fixed upstream but not in it. +# APT_REFRESH: the upgrade only runs when this layer is rebuilt, and a build cache keeps it for as long +# as nothing above it changes — a publish shipped an image whose curl and librsvg were a release behind +# fixes already in the archive. The release build passes the day here, so the layer is rebuilt at +# least daily; empty (the default, a self-hosted build) leaves the cache alone. ARG DENO_VERSION=v2.9.1 -RUN apt-get update \ +ARG APT_REFRESH= +RUN echo "apt refresh: ${APT_REFRESH:-cached}" \ + && apt-get update \ && apt-get upgrade -y --no-install-recommends \ && apt-get install -y --no-install-recommends ffmpeg intel-media-va-driver unzip curl ca-certificates \ && curl -fsSL "https://github.com/denoland/deno/releases/download/${DENO_VERSION}/deno-x86_64-unknown-linux-gnu.zip" -o /tmp/deno.zip \