shadowdaoandClaude Opus 5.5
1ab386f24b
python:3.11-slim ships CPython 3.11's frozen pip 24.0 and setuptools 79.0.1. OSV lists six pip advisories (CVE-2025-8869, CVE-2026-1703, CVE-2026-3219, CVE-2026-6357, CVE-2026-8643, CVE-2026-13346; fixed by 26.2) and two setuptools ones (CVE-2026-59890, GHSA-xmj3-9gf7-h52w; fixed by 84.1.0). Upgrading them first also means the app installs run under a patched pip. After the change the image resolves pip 26.2.2 and setuptools 84.2.1, and an OSV batch query over all 41 installed packages comes back clean (fastapi 0.162.0, starlette 1.10.0, python-multipart 0.0.33, uvicorn 0.54.0, faster-whisper 1.2.1, ...). Trivy finds no fixable Debian 13.7 OS vulnerabilities in the current python:3.11-slim, so no apt upgrade layer is added. Smoke-tested: /health 200 and /transcribe 200 on a generated WAV. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
22 lines
808 B
Docker
22 lines
808 B
Docker
FROM python:3.11-slim
|
|
|
|
# The python:3.11 images freeze the pip and setuptools that shipped with that
|
|
# CPython branch (pip 24.0, setuptools 79), and both have since collected
|
|
# advisories: pip path traversal / tar-symlink / index-URL handling
|
|
# (CVE-2025-8869, CVE-2026-1703, CVE-2026-3219, CVE-2026-6357, CVE-2026-8643,
|
|
# CVE-2026-13346) and setuptools sdist/legacy-wheel path issues
|
|
# (CVE-2026-59890, GHSA-xmj3-9gf7-h52w). Upgrade them first, so the installs
|
|
# below also run under a patched pip.
|
|
RUN pip install --no-cache-dir --upgrade "pip>=26.2" "setuptools>=84.1" \
|
|
&& pip install --no-cache-dir \
|
|
faster-whisper \
|
|
fastapi \
|
|
uvicorn[standard] \
|
|
python-multipart
|
|
|
|
COPY server.py /app/server.py
|
|
|
|
EXPOSE 9876
|
|
|
|
CMD ["uvicorn", "app.server:app", "--host", "0.0.0.0", "--port", "9876"]
|