Merge branch 'release/1.0.0-rc.64'

Author: aramallo

CHANGELOG.md

@@ -1,6 +1,10 @@
 # CHANGELOG
 
-## 1.0.0-rc.63
+## 1.0.0-rc.64
+### Fixes
+* Dockerfile seurity fixes to reduce CVE surface in runtime image
+
+## 1.0.0-rc.64
 ### Performance
 * Registry pattern matching (prefix and wildcard) rewritten as a lock-free persistent Adaptive Radix Trie (`bondy_registry_ptrie`), replacing the `art` library and its serialising gen_server. Match latency drops from ~133µs to ~1µs and reads scale with cores instead of being capped at ~5k ops/s. Per-handle QSBR reclamation is driven by `bondy_registry_ptrie_janitor` processes managed by each registry partition.
 * RPC dealer: removed expensive defensive liveness checks from the call hot path; in-flight promises are now flushed when a Callee dies.

README.md

@@ -5,7 +5,7 @@
 ![Docker Pulls](https://img.shields.io/docker/pulls/leapsight/bondy?style=for-the-badge)
 ![Docker Build (master)](https://img.shields.io/github/actions/workflow/status/bondy-io/bondy/docker_image_build.yaml?&branch=master&label=docker-master&style=for-the-badge)
 ![Docker Build (develop)](https://img.shields.io/github/actions/workflow/status/bondy-io/bondy/docker_image_build.yaml?&branch=develop&label=docker-develop&style=for-the-badge)
-![Docker Build (latest-tag)](https://img.shields.io/github/actions/workflow/status/bondy-io/bondy/docker_image_build.yaml?&tag=version-1.0.0-rc.63&label=docker-1.0.0-rc.63&style=for-the-badge)
+![Docker Build (latest-tag)](https://img.shields.io/github/actions/workflow/status/bondy-io/bondy/docker_image_build.yaml?&tag=version-1.0.0-rc.64&label=docker-1.0.0-rc.64&style=for-the-badge)
 <br>![Architectures](https://img.shields.io/badge/architecture-linux%2Famd64%20%7C%20linux%2Farm64%20%7C%20macOS%2Fintel%20%7C%20macOS%2FM1-lightgrey?style=for-the-badge)
 
 
@@ -165,7 +165,7 @@ make release
 Untar and copy the resulting tarball to the location where you want to install Bondy e.g. `~/tmp/bondy`.
 
 ```shell
-tar -zxvf _build/prod/rel/bondy-1.0.0-rc.63.tar.qz -C ~/tmp/bondy
+tar -zxvf _build/prod/rel/bondy-1.0.0-rc.64.tar.qz -C ~/tmp/bondy
 ```
 
 #### Running

apps/bondy/src/bondy.app.src

@@ -13,10 +13,10 @@
         "Bondy implements the open Web Application Messaging Protocol (WAMP) "
         "and is written in Erlang."
     },
-    {vsn, "1.0.0-rc.63"},
+    {vsn, "1.0.0-rc.64"},
     {registered, []},
     %% We pass the version number in the bondy_app:start/2 arguments
-    {mod, {bondy_app, [{vsn, "1.0.0-rc.63"}]}},
+    {mod, {bondy_app, [{vsn, "1.0.0-rc.64"}]}},
     {applications,[
         %% Erlang/OTP
         stdlib,

deployment/Dockerfile

@@ -1,18 +1,17 @@
 # syntax=docker/dockerfile:1.3
-
 # =============================================================================
 # SPDX-FileCopyrightText: 2016 - 2026 Leapsight
 # SPDX-License-Identifier: Apache-2.0
 # =============================================================================
 
-
 # =============================================================================
 # Build stage 1
 # =============================================================================
-
 FROM erlang:27.3.4 AS builder
 
-# Install build dependencies
+# Install build dependencies.
+# libsnappy-dev (headers) is correct HERE — the NIFs that link snappy are
+# compiled in this stage. The runtime stage only needs the shared library.
 RUN --mount=type=cache,id=apt,sharing=locked,target=/var/cache/apt apt-get update && \
     apt-get -y install --no-install-recommends \
     build-essential \
@@ -21,7 +20,7 @@ RUN --mount=type=cache,id=apt,sharing=locked,target=/var/cache/apt apt-get updat
     libssl-dev \
     libsnappy-dev \
     curl && \
-	rm -rf /var/lib/apt/lists/*
+    rm -rf /var/lib/apt/lists/*
 
 WORKDIR /bondy/src
 
@@ -35,13 +34,18 @@ RUN mkdir -p /bondy/rel
 RUN rebar3 as docker tar && \
     tar -zxvf /bondy/src/_build/docker/rel/*/*.tar.gz -C /bondy/rel/
 
-
 # =============================================================================
 # Build stage 2
 # =============================================================================
-
-# debian bookworm
-FROM debian:stable-slim as runner
+# debian trixie (Debian 13). `debian:stable-slim` rolled from bookworm to
+# trixie, so watch the Debian 13 security tracker for this image.
+#
+# For reproducible, audit-friendly builds, pin the base by digest instead of
+# the floating tag, e.g.:
+#   FROM debian:trixie-slim@sha256:<digest> AS runner
+# You can get the current digest with:
+#   docker buildx imagetools inspect debian:trixie-slim
+FROM debian:trixie-slim AS runner
 
 # We define defaults
 # We assume you have DNS. Erlang will take the FQDN and generate
@@ -55,38 +59,46 @@ ENV ERL_DIST_PORT=27780
 
 # We add Bondy executables to PATH
 ENV PATH="/bondy/bin:$PATH"
+
 # This is required so that relx replaces the vm.args
 # BONDY_ERL_NODENAME and BONDY_ERL_DISTRIBUTED_COOKIE variables
 ENV RELX_REPLACE_OS_VARS=true
 
 ENV HOME "/bondy"
 
-# We install the following utils:
-# - bash
-# - procps: which includes the commands free, kill, pkill, pgrep, pmap, ps,
-#   pwdx, skill, slabtop, snice, sysctl, tload, top, uptime, vmstat, w, and
-#   watch
-# - iproute2: a collection of utilities for networking and traffic control.
-# - net-tools: which includes the commands arp, ifconfig, netstat, rarp, nameif
-#   and route
-# - nano: for devops
+# Runtime packages — kept deliberately minimal to reduce CVE surface.
+#
+#   - bash      : entrypoint / relx boot scripts
+#   - procps    : ps, top, free, kill, sysctl, etc. (ops diagnostics)
+#   - iproute2  : ip, ss (replaces the deprecated net-tools)
+#   - openssl   : required by the Erlang crypto application
+#   - libsnappy1v5 : runtime shared lib for snappy compression (not the -dev headers)
 #
-# We install the following required packages:
-# - openssl: required by Erlang crypto application
-# We setup the bondy group and user and the /bondy dir
-# We also create the /bondy/etc dir to avoid an issue when deploying in K8s
-# where the permissions are not assigned to the directory and Bondy will not
-# have permission to write.
+# Deliberately NOT installed (each removed a CVE class):
+#   - sudo      : container runs as the single non-root `bondy` user; no use for
+#                 it, and it carried a HIGH (CVE-2026-35535).
+#   - dnsutils  : pulls bind9-libs -> libxml2 + libkrb5, the source of 5 HIGH /
+#                 several MEDIUM findings with NO upstream fix. Bondy resolves
+#                 DNS via the Erlang runtime; dig/nslookup are not needed.
+#   - nano      : editor, not needed in a production image (2 CVEs).
+#   - net-tools : deprecated; superseded by iproute2.
+#
+# `apt-get upgrade` ensures base-image packages pick up Debian security updates
+# (glibc, systemd, libcap2, nghttp2, ...) rather than staying frozen at the
+# versions cached in the base layer.
 RUN apt-get update && \
+    apt-get -y upgrade && \
     apt-get -y install --no-install-recommends \
-    sudo bash procps iproute2 net-tools dnsutils nano openssl libsnappy-dev \
+        bash procps iproute2 openssl libsnappy1v5 \
+    && apt-get -y autoremove && apt-get clean \
     && rm -rf /var/lib/apt/lists/* \
     && groupadd -g 1000 -r bondy \
     && useradd -u 1000 -r -g bondy -d /bondy -s /bin/bash -c "bondy" bondy \
     && mkdir -p /bondy/etc \
     && chown bondy:bondy /bondy/etc
 
 WORKDIR /bondy
+
 USER bondy:bondy
 
 # Copy the release to workdir
@@ -99,7 +111,7 @@ COPY --chown=bondy:bondy --from=builder /bondy/rel .
 EXPOSE 18080/tcp
 # ADMIN API HTTP (Default: 18081)
 EXPOSE 18081/tcp
-# WAMP TCP  (Default: 18082)
+# WAMP TCP (Default: 18082)
 EXPOSE 18082/tcp
 # API GATEWAY HTTPS and WSS (Default: 18083)
 EXPOSE 18083/tcp

rebar.config

@@ -155,7 +155,7 @@
 
 
 {relx, [
-    {release, {bondy, "1.0.0-rc.63"},[
+    {release, {bondy, "1.0.0-rc.64"},[
         %% Erlang/OTP
         crypto,
         inets,