Skip to content

Conversation

@TommyTran732
Copy link

Upstream doesn't always ship the latest packages on Debian, so it is good practice to run an apt-get full-upgrade. This is important to patch vulnerabilities for stuff like OpenSSL for example.

Upstream doesn't always ship the latest packages on Debian, so it is good practice to run an apt-get full-upgrade. This is important to patch vulnerabilities for stuff like OpenSSL for example.
@TheArcaneBrony
Copy link
Contributor

I don't believe this PR is a good fit for the project. General system maintenance is the responsibility of the end user, not the individual applications you install, nor does it make any difference in the final result.
Draupnir does not use OpenSSL anyhow (outside of nodejs itself, which is an implementation detail and not a direct dependency of Draupnir).

@TheArcaneBrony
Copy link
Contributor

I checked a little bit closer, and it seems you're updating the dockerfile - here it's even more problematic because updating the system's packages rather than updating the base image itself is a dramatic increase in closure size.

@TommyTran732
Copy link
Author

TommyTran732 commented Nov 11, 2025

Draupnir does not use OpenSSL anyhow (outside of nodejs itself, which is an implementation detail and not a direct dependency of Draupnir).

Doesn't matter, do you wanna make calls to your Matrix server with an admin token with vulnerable OpenSSL?

I checked a little bit closer, and it seems you're updating the dockerfile - here it's even more problematic because updating the system's packages rather than updating the base image itself is a dramatic increase in closure size.

As discussed on Matrix, the Node image is based on the Buildpack image, which in turn is based on the Debian image, all of which only gets updated about once a month. On top of that, Draupnir itself only gets a new release around once a month Depending on how things line up, the Draupnir image will either go out of date anywhere from 1 day out of date to 2 months out of date.

dramatic increase in closure size

No it doesn't. The only thing that would do this is /var/apt/cache which can be dealt with by a simple && rm -rf /var/cache/apt

@Gnuxie Gnuxie self-requested a review November 11, 2025 13:41
@Gnuxie
Copy link
Member

Gnuxie commented Nov 11, 2025

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants