Dockerfile

# Build stage
FROM python:3.11-slim as builder
ENV PATH="/root/.local/bin/:$PATH"

RUN apt-get update \
    && dpkg --add-architecture arm64 \
    && apt-get install -y --no-install-recommends curl gcc patch \
    && pip3 install --no-cache-dir --upgrade pip \
    && rm -rf /var/lib/apt/lists/*

RUN mkdir /app
WORKDIR /app

ENV ENV_TYPE=DEV

# Create and activate virtual environment
RUN python -m venv /app/venv --upgrade-deps && \
    . /app/venv/bin/activate

ENV VIRTUAL_ENV=/app/venv
ENV PATH="$VIRTUAL_ENV/bin:$PATH"

# Install Poetry
RUN curl -sSL https://install.python-poetry.org | python3 -
RUN poetry config virtualenvs.create false

# Install gcc to compile ruamel.yaml.clib, wheel is missing.
RUN pip3 install --no-cache-dir ruamel.yaml.clib==0.2.8

# Install project dependencies
COPY pyproject.toml poetry.lock /app/
RUN poetry install --no-root --without dev --extras "all"

# Copy project source code
COPY src/ /app/src
RUN poetry install --without dev --extras "all"

# Install playbooks
COPY playbooks/ /etc/robusta/playbooks/defaults
RUN pip install --no-cache-dir /etc/robusta/playbooks/defaults

# Patching CVE-2026-24049 (High): wheel path traversal vulnerability
RUN pip install --no-cache-dir "wheel>=0.46.2"

# Fixes k8s library bug - see https://github.com/kubernetes-client/python/issues/1867#issuecomment-1353813412
RUN find /app/venv/lib/python*/site-packages/kubernetes/client/rest.py -type f -exec sed -i 's:^\(.*logger.*\)$:#\1:' {} \;

# See https://github.com/kubernetes-client/python/issues/1921 and https://github.com/tomplus/kubernetes_asyncio/issues/247
# Fix based on files at end of https://github.com/tomplus/kubernetes_asyncio/pull/300/files
RUN echo ">>> don't deep-copy configuration for local_vars_configuration in models"
COPY scripts/client_configuration_get_default_patch.diff /app/client_configuration_get_default_patch.diff
RUN patch "/app/venv/lib/python3.11/site-packages/kubernetes/client/configuration.py" "/app/client_configuration_get_default_patch.diff"
RUN find "/app/venv/lib/python3.11/site-packages/kubernetes/client/models/" -type f -print0 | xargs -0 sed -i 's/local_vars_configuration = Configuration.get_default_copy()/local_vars_configuration = Configuration.get_default()/g'
RUN find "/app/venv/lib/python3.11/site-packages/kubernetes/client/models/" -type f -print0 | xargs -0 sed -i 's/local_vars_configuration = Configuration()/local_vars_configuration = Configuration.get_default()/g'

# kubectl: CVE-patched static binary (see scripts/build_go_binaries.sh).
# dpkg picks the target arch without BuildKit's TARGETARCH.
COPY bin/go-cve-rebuild /tmp/go-cve-rebuild
RUN cd /tmp/go-cve-rebuild/$(dpkg --print-architecture) && sha256sum -c kubectl.gz.sha256 \
    && gunzip -c kubectl.gz > /usr/local/bin/kubectl && chmod +x /usr/local/bin/kubectl

# Final stage
FROM python:3.11-slim


ENV ENV_TYPE=DEV
ENV PYTHONUNBUFFERED=1
ENV VIRTUAL_ENV=/app/venv
ENV PATH="/venv/bin:$PATH"
ENV PYTHONPATH=$PYTHONPATH:.:/app/src

WORKDIR /app

# Install necessary packages for the runtime environment
# We're installing here libexpat1, to upgrade the package to include a fix to 3 high CVEs. CVE-2024-45491,CVE-2024-45490,CVE-2024-45492
# Patching glibc for CVE-2026-0861, CVE-2026-0915, CVE-2025-15281
# Patching pcre2 for CVE-2026-89161, CVE-2026-89157 (High), CVE-2026-89160, CVE-2026-89158,
# CVE-2026-89156 (Medium) - fixed in trixie-security 10.46-1~deb13u3
# We install openssh-client rather than the "ssh" metapackage: only the ssh *client* is used
# (GIT_SSH_COMMAND when cloning playbook repos over git@). The metapackage also pulls in
# openssh-server and openssh-sftp-server, which are never used and carry unfixed CVEs
# (CVE-2026-60002 (Critical) and others with no fixed Debian package available).
# gnupg2 is intentionally not installed - the kubectl apt key is consumed in ASCII-armored
# form below, which avoids the whole gnupg/dirmngr/gpgsm package family and its unfixed
# CVE-2026-24882 (High).
RUN apt-get update \
    && dpkg --add-architecture arm64 \
    && pip3 install --no-cache-dir --upgrade pip \
    && apt-get install -y --no-install-recommends git openssh-client curl fonts-dejavu-core apt-transport-https \
    && apt-get install -y --no-install-recommends libexpat1 libc6 libc-bin libcap2 libpcre2-8-0 \
    && rm -rf /var/lib/apt/lists/*

# Debian trixie ships no fix for libssh2/attr/acl or perl ("vulnerable, no DSA" in the
# Debian security tracker), so the patched packages are pulled from forky with a
# per-package pin. Nothing else is resolved against testing - the preferences file below
# blocks every forky package except the ones named, and the sources are removed again in
# the same layer. Package names are ":any"-qualified (and so is the "Package: *" block)
# because arm64 is registered as a foreign architecture below - an unqualified name only
# pins the native arch, which would leave arm64 resolution unpinned/unblocked.
# - libssh2/libattr1/libacl1: CVE-2026-58050/58051/66032/66033/66034/66035, CVE-2026-54371,
#   CVE-2026-54369/54370.
# - perl-base/perl: CVE-2026-57433, CVE-2026-13221, CVE-2026-57432, CVE-2026-15534,
#   CVE-2026-19487. forky's perl pre-depends on glibc >= 2.43, so libc6/libc-bin/
#   libc-gconv-modules-extra/libcrypt1 come along too. git hard-depends on perl (Debian
#   builds them from the same source with locked versions), so git/git-man/liberror-perl/
#   perl-modules-5.42/libperl5.42 are pulled up to forky's git 2.53.0 as well - trying to
#   pin perl-base alone makes apt remove git instead of upgrading it. trixie's
#   libperl5.40/perl-modules-5.40 are left orphaned by the upgrade (and still carry
#   CVE-2026-9538), so they are purged.
# - openssh, curl, expat, util-linux, ncurses, systemd: no trixie fix.
RUN echo 'deb http://deb.debian.org/debian forky main' > /etc/apt/sources.list.d/forky.list \
    && printf 'Package: libssh2-1t64:any libattr1:any libacl1:any perl-base:any perl:any perl-modules-5.42:any libperl5.42:any liberror-perl:any git:any git-man:any libc6:any libcrypt1:any libc-bin:any libc-gconv-modules-extra:any libexpat1:any libtinfo6:any libncursesw6:any ncurses-base:any ncurses-bin:any libsystemd0:any libudev1:any systemd-standalone-sysusers:any openssh-client:any openssh-common:any curl:any libcurl4t64:any libcurl3t64-gnutls:any libcurl4-gnutls:any libnghttp3-9:any libngtcp2-16:any libngtcp2-crypto-ossl0:any libngtcp2-crypto-gnutls8:any util-linux:any bsdutils:any mount:any libblkid1:any libmount1:any libsmartcols1:any liblastlog2-2:any libuuid1:any login:any\nPin: release n=forky\nPin-Priority: 990\n\nPackage: *:any\nPin: release n=forky\nPin-Priority: -1\n' > /etc/apt/preferences.d/99-forky \
    && apt-get update \
    && apt-get install -y --no-install-recommends libssh2-1t64 libattr1 libacl1 perl-base perl perl-modules-5.42 libperl5.42 liberror-perl git git-man libc6 libcrypt1 libc-bin libc-gconv-modules-extra \
       libexpat1 libtinfo6 libncursesw6 ncurses-base ncurses-bin libsystemd0 libudev1 openssh-client curl libcurl4t64 libcurl3t64-gnutls util-linux bsdutils mount libblkid1 libmount1 libsmartcols1 liblastlog2-2 libuuid1 login \
    && apt-get purge -y libperl5.40 perl-modules-5.40 \
    && rm -f /etc/apt/sources.list.d/forky.list /etc/apt/preferences.d/99-forky \
    && rm -rf /var/lib/apt/lists/*

# Patching CVE-2024-32002
RUN git config --global core.symlinks false

# Temporary setuptools CVE fix untill python:3.12-slim image will be used.
RUN rm -rf /usr/local/lib/python3.11/ensurepip/_bundled/setuptools-65.5.0-py3-none-any.whl
RUN rm -rf /usr/local/lib/python3.11/site-packages/setuptools-65.5.1.dist-info

# Patching CVE-2026-24049 (High): wheel path traversal vulnerability
# Patching CVE-2026-23949 (High): jaraco.context path traversal vulnerability (vendored in setuptools)
RUN pip3 install --no-cache-dir "wheel>=0.46.2" "setuptools>=80.10.1" \
    && rm -rf /usr/local/lib/python3.11/site-packages/setuptools/_vendor/wheel-0.45.1.dist-info

COPY --from=builder /app/venv /venv
COPY --from=builder /etc/robusta/playbooks/defaults /etc/robusta/playbooks/defaults
# Copy virtual environment and application files from the build stage
COPY --from=builder /app /app
# remove duplicated /app/venv - already copied to /venv
RUN rm -rf /app/venv
# Remove vendored wheel 0.45.1 from setuptools in venv (CVE-2026-24049)
# and virtualenv's embedded wheel 0.45.1 seed, which it only uses for Python 3.8 environments
RUN rm -rf /venv/lib/python3.11/site-packages/setuptools/_vendor/wheel* \
    /venv/lib/python3.11/site-packages/virtualenv/seed/wheels/embed/wheel-0.45.1-py3-none-any.whl

# Set up kubectl
COPY --from=builder /usr/local/bin/kubectl /usr/bin/kubectl
RUN kubectl version --client

# Run the application
# -u disables stdout buffering https://stackoverflow.com/questions/107705/disable-output-buffering
CMD [ "python3", "-u", "-m", "robusta.runner.main"]