Skip to main content

RFC — Upgrade runtime base Alpine 3.18 (EOL) → 3.21/3.22

Bucket item: A2 · Class: 🔴 Expedite (security) · Jira Story: TF-3502 · Epic: TF-3500

Context / Problem​

Alpine 3.18 reached End of Life on 2025-05-01 — it receives no further security fixes. The final runtime image is built FROM alpine:3.18 (Dockerfile:39). Upgrade the runtime base to a supported Alpine (3.21 or 3.22).

This is classed 🔴 Expedite because it is security-facing (an unpatched base OS reaches every paying customer). It is currently backlog; if pulled in flight it must be logged in the bucket README ## Expedite log (WIP ≤ 2).

Proposed change​

Bump the final-stage base image to a supported Alpine and rebuild the native dependencies against the new musl / OpenSSL.

Execution plan (call to action)​

  1. Dockerfile:39 → FROM alpine:3.22 (or 3.21 — pick the newest that all native deps support).
  2. Rebuild native deps against the new musl/OpenSSL: librdkafka, openssl-dev, zstd-dev.
  3. Verify pkg-config paths still resolve in the build stage; fix any moved .pc locations.
  4. Smoke-test the built image: Kafka connectivity (librdkafka), TLS (OpenSSL), and zstd paths.
  5. Scan the new image (Trivy/Grype) to confirm the EOL-base advisories clear.

Risks & rollback​

  • Risk: medium — native-dep ABI / musl / OpenSSL differences can break at runtime, not build time; step 4 smoke test is the gate.
  • Rollback: revert the FROM line; but note this returns to an unsupported base — treat rollback as temporary only.

Open questions​

  1. Target 3.21 or 3.22? Pick per librdkafka/zstd support in the chosen tag.
  2. Do any pinned apk package versions no longer exist in the new Alpine repo?
  3. Sequence with A1 (Go bump) if the builder image also moves.