How about producing a minimal image, ie. one that only contains the scryer-prolog binary, libc6, libnss, and as few other libraries as possible?
Most of the stuff listed in the vulnerability report (perl-base, libsystemd0, e2fsprogs, ...) are not needed in a Scryer image; if the image contains only the bare minimum, updates will be required less often, too.

Basically something like this:

# Installation as now

RUN mkdir /image
RUN rsync -vaR \
      /usr/local/bin/scryer-prolog \
      /usr/lib64/... and other files \
    /image/

# Last stage, return actual image
FROM scratch

COPY --from=0 /image/ /
CMD ["/usr/local/bin/scryer-prolog", "--no-add-history"]

That's what we're doing, see https://gitlab.opencode.de/brz/containerplattform/minimal-image.

Another idea would be to remove all unnecessary packages, but that means fighting dpkgs notion of essential packages and is (in my experience) not faster - it just leaves more stuff behind, as the granularity is higher (packages instead of files).

If there's a list of required files, and from that a list of required packages, a periodic job can check whether one of these changed - and only then run the GitHub build process.
Doing that for latest and the last release (which could be hardcoded in the script) should be good enough, IMO.

Docker image outdated #2646

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions