Provide official fluentbit docker image based on new Debian Trixie (13) #11063
Description
Is your feature request related to a problem? Please describe.
The current official docker image provided by the project is based on Debian Bookworm (12)
Because of that some security scanner reports those two important CVE :
Here with Trivy :
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
│ libldap-2.5-0 │ CVE-2023-2953 │ HIGH │ 2.5.13+dfsg-5 │ │ openldap: null pointer dereference in ber_memalloc_x https://avd.aquasec.com/nvd/cve-2023-2953 │
│ zlib1g │ CVE-2023-45853 │ CRITICAL │ 1:1.2.13.dfsg-1 │ │ zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 https://avd.aquasec.com/nvd/cve-2023-45853 │
Debian team seems to considered them harmless and did not planned any fix, but still there presence calls for concerns and discussions with corporate security teams.
Describe the solution you'd like
Now that Fluentbit 4.1 is compatible with Debian Trixie (13), it would be valuable if the project could propose official images based on Debian Trixie (13) which don't have those particular CVEs.
Describe alternatives you've considered
Building and maintaining a custom image would probably be possible, but such official image would benefit quickly to the whole community
Activity
patrick-stephens commentedon Oct 22, 2025
I think this is a duplicate, I attempted a PR the other week and hit issues: #11006
It should be noted the distroless base image for Trixie wasn't available until recently: GoogleContainerTools/distroless#1851
farrault commentedon Oct 22, 2025
Sorry @patrick-stephens ... I only searched "Trixie" in the issues not the PRs
Good to know you already started to work on that.
patrick-stephens commentedon Oct 22, 2025
No problem, I'm sure there was another recently but I cannot find it either! I was subscribed to the distroless issue anyway waiting for that image to be stable
patrick-stephens commentedon Dec 1, 2025
I've got it working for our enterprise distribution so have pushed that to OSS now: telemetryforge/agent#139
patrick-stephens commentedon Dec 1, 2025
However the base image is still in preview: https://github.com/GoogleContainerTools/distroless?tab=readme-ov-file#debian-13-preview