Repository navigation
ci: add a CA bundle to debian-base - #39570
Merged
Conversation
Since reqwest moved to rustls with rustls-platform-verifier (MaterializeInc#39415), building a reqwest client on Linux fails when the system has no CA bundle. debian-base ships none, so metabase-smoketest panics at startup and the nightly Metabase job has failed since. The mz-debug, mz-deploy and kgen images are built on the same base with the same dependency. Install ca-certificates in a separate stage and copy only the bundle, since the package also pulls the openssl CLI into the image. Closes: SEC-740 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bosconi
approved these changes
Oct 6, 2026
bosconi
left a comment
bosconi
left a comment
Member
There was a problem hiding this comment.
Looks good. One small comment improvement.
Comment on lines
+10
to
+12
| # `ca-certificates` depends on the `openssl` CLI, so install it in a separate | ||
| # stage and copy only the bundle into the final image. | ||
| FROM debian:13-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a AS ca-certs |
Member
There was a problem hiding this comment.
dependabot handles keeping the two digest pins in sync. /misc/images/debian-base is in .github/dependabot.yml, and it bumps every debian:13-slim pin in a Dockerfile in one PR. For example, #39383 bumped both the apt-deps and useradd stages in distroless-prod-base. distroless-prod-base says this in a comment. Doing the same here tells the next reader they don't need to bump the pins by hand:
Suggested change
| # `ca-certificates` depends on the `openssl` CLI, so install it in a separate | |
| # stage and copy only the bundle into the final image. | |
| FROM debian:13-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a AS ca-certs | |
| # `ca-certificates` depends on the `openssl` CLI, so install it in a separate | |
| # stage and copy only the bundle into the final image. Dependabot bumps this | |
| # digest pin together with the final stage's. | |
| FROM debian:13-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a AS ca-certs |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes: SEC-740
Since #39415 moved reqwest to rustls with
rustls-platform-verifier, building a reqwest client on Linux fails if the system has no CA bundle.debian-baseships none, sometabase-smoketestpanics at startup ("No CA certificates were loaded from the system") and the nightly Metabase job has been red since 2026-10-01. Themz-debug,mz-deployandkgenimages sit on the same base and use the same reqwest.debian-basenow gets/etc/ssl/certs/ca-certificates.crtfrom a separate build stage, so theopensslCLI that theca-certificatespackage depends on stays out of the image. This follows the pattern indistroless-prod-base.Risks: the stage's
debian:13-slimdigest pin must be bumped with the final stage's. Images that already installca-certificatesthemselves regenerate the bundle over the copied one, which is harmless.Tests: none added. The nightly Metabase job covers this.
🤖 Generated with Claude Code