fix(docker): drop procps so the combined FalkorDB image builds on trixie#1628
fix(docker): drop procps so the combined FalkorDB image builds on trixie#1628irresi wants to merge 1 commit into
Conversation
falkordb/falkordb:latest is now Debian 13 "trixie" based and no longer ships perl (purged upstream in FalkorDB/FalkorDB#1800 to reduce CVE surface). procps's postinst runs update-rc.d, a perl script, so the first apt-get install layer of mcp_server/docker/Dockerfile exits 100 and every from-source build of the combined image fails. Nothing in the repo invokes any procps tool (ps, pgrep, top, ...): the healthcheck uses redis-cli and start-services.sh uses only redis-server, redis-cli, node, and uv. Drop the package instead of reinstalling perl-base, and update the stale Debian bookworm / Python 3.11 note. Verified against falkordb/falkordb@sha256:2496643c: the unmodified apt layer exits 100 with "procps.postinst: update-rc.d: not found"; with procps dropped the full image builds end-to-end and the container comes up healthy (FalkorDB PONG, MCP server serving /mcp/). Closes getzep#1624 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
I have read the CLA Document and I hereby sign the CLA behalf on myself, e-mail: example@example.com or I have read the CLA Document and I hereby sign the CLA behalf of my company, e-mail: example@example.com Signature is valid for 6 months. This bot will be retriggered when the Contributor License Agreement comment has been provided. Posted by the CLA Assistant Lite bot. |
|
I have read the CLA Document and I hereby sign the CLA behalf on myself, e-mail: blueirobin02@gmail.com |
|
@irresi Verified this: procps postinst fails on the trixie base (needs perl/update-rc.d that were purged), and nothing in the image uses ps/pgrep. Builds clean with your change. LGTM! |
Summary
docker build -f mcp_server/docker/Dockerfile mcp_server/currently fails on a pristine checkout ofmain, because the base imagefalkordb/falkordb:latestno longer ships perl.The base image moved to Debian 13 "trixie" and upstream deliberately purged
perl-baseto reduce CVE surface (FalkorDB/FalkorDB#1800, merged 2026-04-05).procps's post-installation script runsupdate-rc.d, which is a perl script (#!/usr/bin/perl), so the very firstRUN apt-get install ...layer dies:This blocks every from-source build of the combined FalkorDB + MCP image. It is also a latent release blocker: the
combinedmatrix variant of.github/workflows/release-mcp-server.ymlbuilds this exact Dockerfile against the same unpinned:latest, so the nextmcp-v*tag push would hit the same failure (the last run of that workflow wasmcp-v1.0.2on 2026-03-11, before the upstream change).Fix
Drop
procpsfrom theapt-get installlist and update the stale "Debian Bookworm / Python 3.11" note (the base is now trixie with Python 3.13).Why this over the alternatives:
ps/pgrep/top/etc. The container healthcheck usesredis-cli ping;start-services.shusesredis-server,redis-cli,node, anduvonly. The one in-containerps auxsighting I could find (a user debugging [BUG] FalkorDB Browser not started by MCP Server image #1041) is still covered bydocker top <container>from the host or/procinside it.perl-basealso fixes the build (verified — the apt layer then completes andpsworks), but it partially undoes the base image's deliberate CVE-surface reduction just to keep a package nothing consumes. Happy to switch to that variant if you'd rather keeppsavailable for debugging the multi-process container.falkordb/falkordbtag from v4.18.0 (2026-04-07) onward is built after the perl purge; only tags ≤ v4.16.9 (2026-04-03) still ship perl, and pinning that far back would freeze FalkorDB itself.Type of Change
Testing
All against
falkordb/falkordb:latestat digestsha256:2496643cabd67e87fd82458383400c049324daec1fe674ba0db4c5bdaca5d25f(same digest as the issue report):RUNline —apt-getexits100with theprocps.postinsterror above.procpsremoved, the sameapt-getline completes with exit0.perl-basewhile keepingprocpsalso builds cleanly (ps from procps-ng 4.0.4), confirming the failure is exactly the procps→update-rc.d→perl chain and nothing else in the layer.docker build -f mcp_server/docker/Dockerfile mcp_server/of this branch completes successfully end-to-end (includinguv lockregeneration anduv syncon Python 3.13).Breaking Changes
None to the build interface. The image no longer contains
ps/top/free(procps) — repo-wide search found zero consumers.Related Issues
Closes #1624
🤖 Generated with Claude Code