1
0
mirror of synced 2026-05-22 22:53:35 +00:00

fix: swap UV base images to public.ecr.aws Python + uv binary copy (#1461)

Replaces `ghcr.io/astral-sh/uv:python<ver>-bookworm-slim` with
`public.ecr.aws/docker/library/python:<ver>-slim-trixie` and copies
the `uv`/`uvx` binaries from `ghcr.io/astral-sh/uv:latest`.

The bookworm base ships an OpenSSL build affected by a CVE; trixie
ships the patched version (OpenSSL 3.5.5). Python minor versions are
preserved per Dockerfile (3.11/3.12/3.13/3.14) so dependency
resolution is unchanged.

Verified end-to-end on the riskiest Dockerfile
(claude-agent/claude-sdk — apt nodejs via NodeSource, uv pip install,
Python 3.11): image builds, container starts, /ping returns healthy.
This commit is contained in:
Tejas Kashinath
2026-05-11 11:44:58 -04:00
committed by GitHub
parent c7c1d16cb2
commit 68c41d5710
22 changed files with 44 additions and 27 deletions
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.14-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.14-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.12-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
+2 -2
View File
@@ -1,5 +1,5 @@
# Use uv's ARM64 Python base image
FROM --platform=linux/arm64 ghcr.io/astral-sh/uv:python3.12-bookworm-slim
FROM --platform=linux/arm64 public.ecr.aws/docker/library/python:3.12-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
+2 -2
View File
@@ -1,5 +1,5 @@
# Use uv's x86_64 Python base image
FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.12-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
@@ -1,5 +1,5 @@
# Base image
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
# Environment variables
ENV UV_SYSTEM_PYTHON=1 \
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# Configure UV for container environment
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
+2 -1
View File
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.12-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.11-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.11-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.11-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
@@ -1,5 +1,5 @@
# Use uv's ARM64 Python base image
FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.11-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
ENV UV_SYSTEM_PYTHON=1 \
UV_PROJECT_ENVIRONMENT="/usr/local/" \
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# All environment variables in one layer
@@ -1,5 +1,5 @@
# Use ARM64 Python 3.11 base image with uv pre-installed
FROM --platform=linux/arm64 ghcr.io/astral-sh/uv:python3.11-bookworm-slim
FROM --platform=linux/arm64 public.ecr.aws/docker/library/python:3.11-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
# Set working directory
WORKDIR /app
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# Configure UV for container environment
@@ -1,4 +1,5 @@
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
FROM public.ecr.aws/docker/library/python:3.13-slim-trixie
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
WORKDIR /app
# Configure UV for container environment