Skip to content

Provide official fluentbit docker image based on new Debian Trixie (13) #11063

Closed

Description

@farrault

Is your feature request related to a problem? Please describe.
The current official docker image provided by the project is based on Debian Bookworm (12)
Because of that some security scanner reports those two important CVE :

Here with Trivy :
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
│ libldap-2.5-0 │ CVE-2023-2953 │ HIGH │ 2.5.13+dfsg-5 │ │ openldap: null pointer dereference in ber_memalloc_x https://avd.aquasec.com/nvd/cve-2023-2953 │
│ zlib1g │ CVE-2023-45853 │ CRITICAL │ 1:1.2.13.dfsg-1 │ │ zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 https://avd.aquasec.com/nvd/cve-2023-45853 │

Debian team seems to considered them harmless and did not planned any fix, but still there presence calls for concerns and discussions with corporate security teams.

Describe the solution you'd like

Now that Fluentbit 4.1 is compatible with Debian Trixie (13), it would be valuable if the project could propose official images based on Debian Trixie (13) which don't have those particular CVEs.

Describe alternatives you've considered
Building and maintaining a custom image would probably be possible, but such official image would benefit quickly to the whole community

Activity

  1. patrick-stephens commented on Oct 22, 2025

    @patrick-stephens
    Contributor

    I think this is a duplicate, I attempted a PR the other week and hit issues: #11006

    It should be noted the distroless base image for Trixie wasn't available until recently: GoogleContainerTools/distroless#1851

  2. farrault commented on Oct 22, 2025

    @farrault
    Author

    Sorry @patrick-stephens ... I only searched "Trixie" in the issues not the PRs

    Good to know you already started to work on that.

  3. patrick-stephens commented on Oct 22, 2025

    @patrick-stephens
    Contributor

    No problem, I'm sure there was another recently but I cannot find it either! I was subscribed to the distroless issue anyway waiting for that image to be stable

  4. patrick-stephens commented on Dec 1, 2025

    @patrick-stephens
    Contributor

    I've got it working for our enterprise distribution so have pushed that to OSS now: telemetryforge/agent#139

  5. linked a pull request that will close this issuedockerfile: update to Debian Trixie #11006on Dec 1, 2025
  6. patrick-stephens commented on Dec 1, 2025

    @patrick-stephens
    Contributor
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions