From 20bec67265a34a98fcd600edecd43e55a833a13a Mon Sep 17 00:00:00 2001 From: Gerd Zellweger Date: Fri, 7 Aug 2026 08:52:03 -0700 Subject: [PATCH] deploy: drop the Go toolchain from the runtime image Go is a build dependency of aws-lc-fips-sys, which only enters the dependency graph behind the fips cargo feature. The runtime image compiles pipelines, and the generated pipeline workspace never enables that feature, so nothing the image builds has needed Go since #5488 made FIPS opt-in. The toolchain has been carried since then at 258 MB, and its Ubuntu package ships CVEs that fail the image scan, which is why it came from an upstream tarball and was bumped three times. Verified by building the image and compiling a pipeline dependency inside it with no go on PATH. Signed-off-by: Gerd Zellweger --- README.md | 2 +- deploy/Dockerfile | 11 ----------- 2 files changed, 1 insertion(+), 12 deletions(-) diff --git a/README.md b/README.md index 3caec5facae..64c8afd8396 100644 --- a/README.md +++ b/README.md @@ -113,7 +113,7 @@ To run Feldera from sources, ensure at least 6 GB of free space in the sources d - cmake - libssl-dev - libsasl2-dev -- golang-go (required to build aws-lc-fips-sys when using rustls FIPS) +- golang-go (only to build with `--features fips`, which compiles aws-lc-fips-sys from source; a default build does not need it) - pkg-config - libzstd-dev - clang diff --git a/deploy/Dockerfile b/deploy/Dockerfile index 2ebef2bfc62..d461f1e07e1 100644 --- a/deploy/Dockerfile +++ b/deploy/Dockerfile @@ -77,17 +77,6 @@ RUN arch=`dpkg --print-architecture | sed "s/arm64/aarch64/g" | sed "s/amd64/x86 ENV PATH="$PATH:/home/ubuntu/.cargo/bin:/home/ubuntu/mold/bin" ENV RUSTFLAGS="-C link-arg=-fuse-ld=mold -C link-arg=-Wl,--compress-debug-sections=zlib" -# Go is required to build aws-lc-fips-sys when rustls is built with FIPS. -# Installed from upstream rather than Ubuntu's golang-go package because the -# 24.04 package is stuck at 1.22.2 and ships many unfixed CVEs that fail our -# image scan. Revert to apt's golang-go once Ubuntu ships a patched version. -RUN arch=`dpkg --print-architecture`; \ - curl -LO https://go.dev/dl/go1.26.5.linux-$arch.tar.gz \ - && tar -xzf go1.26.5.linux-$arch.tar.gz \ - && mv go goroot \ - && rm go1.26.5.linux-$arch.tar.gz -ENV PATH="$PATH:/home/ubuntu/goroot/bin" - # Install Samply for profiling RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/feldera/samply/releases/download/v0.13.2/samply-installer.sh | sh