From 742c90bbd22b29a15a769f13ae67d9bed96a07a3 Mon Sep 17 00:00:00 2001 From: Jesse Turner Date: Thu, 14 May 2026 13:13:24 -0400 Subject: [PATCH 1/4] fix: replace third-party base image with AWS public ECR image Switch Python container Dockerfile from ghcr.io/astral-sh/uv:python3.12-bookworm-slim to public.ecr.aws/docker/library/python:3.12-slim to remediate CVE-2026-31789 (OpenSSL). The uv binary is copied from the official image via multi-stage COPY --from. Constraint: Must preserve uv-based dependency management workflow Rejected: pip install uv | adds network call and slower builds Confidence: high Scope-risk: narrow --- .../__snapshots__/dockerfile-render.test.ts.snap | 8 ++++++-- src/assets/container/python/Dockerfile | 4 +++- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap index bd8eb132f..4c9f989cb 100644 --- a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap +++ b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap @@ -1,7 +1,9 @@ // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html exports[`Dockerfile enableOtel rendering > renders opentelemetry-instrument CMD when enableOtel is true > Dockerfile-enableOtel-true 1`] = ` -"FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim +"FROM public.ecr.aws/docker/library/python:3.12-slim + +COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/ ARG UV_DEFAULT_INDEX ARG UV_INDEX @@ -39,7 +41,9 @@ CMD ["opentelemetry-instrument", "python", "-m", "main"] `; exports[`Dockerfile enableOtel rendering > renders plain python CMD when enableOtel is false > Dockerfile-enableOtel-false 1`] = ` -"FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim +"FROM public.ecr.aws/docker/library/python:3.12-slim + +COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/ ARG UV_DEFAULT_INDEX ARG UV_INDEX diff --git a/src/assets/container/python/Dockerfile b/src/assets/container/python/Dockerfile index ec82f36fa..990c42df1 100644 --- a/src/assets/container/python/Dockerfile +++ b/src/assets/container/python/Dockerfile @@ -1,4 +1,6 @@ -FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim +FROM public.ecr.aws/docker/library/python:3.12-slim + +COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/ ARG UV_DEFAULT_INDEX ARG UV_INDEX From e1ce981e3f451bbbb21d3ca920369db5b57a49bc Mon Sep 17 00:00:00 2001 From: Jesse Turner Date: Thu, 14 May 2026 13:22:05 -0400 Subject: [PATCH 2/4] =?UTF-8?q?fix:=20address=20review=20=E2=80=94=20use?= =?UTF-8?q?=20pip=20install=20uv,=20fix=20import=20command,=20update=20doc?= =?UTF-8?q?s?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Replace COPY --from with pip install uv==0.11.14 to fully eliminate third-party image pull at build time - Update agentcore import Dockerfile generation to use AWS ECR base image - Update docs/container-builds.md to reflect new base image setup Constraint: No AWS-hosted uv binary available; pip install is the cleanest path Confidence: high Scope-risk: narrow --- docs/container-builds.md | 3 ++- .../__tests__/__snapshots__/dockerfile-render.test.ts.snap | 4 ++-- src/assets/container/python/Dockerfile | 2 +- src/cli/commands/import/actions.ts | 3 ++- 4 files changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/container-builds.md b/docs/container-builds.md index 4abdde81c..964b69371 100644 --- a/docs/container-builds.md +++ b/docs/container-builds.md @@ -39,7 +39,8 @@ app/MyAgent/ ## Generated Dockerfile -The template uses `ghcr.io/astral-sh/uv:python3.12-bookworm-slim` as the base image with these design choices: +The template uses `public.ecr.aws/docker/library/python:3.12-slim` as the base image (with `uv` installed via +`pip install uv==0.11.14`) with these design choices: - **Layer caching**: Dependencies (`pyproject.toml`) are installed before copying application code - **Non-root**: Runs as `bedrock_agentcore` (UID 1000) diff --git a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap index 4c9f989cb..05de7d843 100644 --- a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap +++ b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap @@ -3,7 +3,7 @@ exports[`Dockerfile enableOtel rendering > renders opentelemetry-instrument CMD when enableOtel is true > Dockerfile-enableOtel-true 1`] = ` "FROM public.ecr.aws/docker/library/python:3.12-slim -COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/ +RUN pip install --no-cache-dir uv==0.11.14 ARG UV_DEFAULT_INDEX ARG UV_INDEX @@ -43,7 +43,7 @@ CMD ["opentelemetry-instrument", "python", "-m", "main"] exports[`Dockerfile enableOtel rendering > renders plain python CMD when enableOtel is false > Dockerfile-enableOtel-false 1`] = ` "FROM public.ecr.aws/docker/library/python:3.12-slim -COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/ +RUN pip install --no-cache-dir uv==0.11.14 ARG UV_DEFAULT_INDEX ARG UV_INDEX diff --git a/src/assets/container/python/Dockerfile b/src/assets/container/python/Dockerfile index 990c42df1..5047dcc66 100644 --- a/src/assets/container/python/Dockerfile +++ b/src/assets/container/python/Dockerfile @@ -1,6 +1,6 @@ FROM public.ecr.aws/docker/library/python:3.12-slim -COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/ +RUN pip install --no-cache-dir uv==0.11.14 ARG UV_DEFAULT_INDEX ARG UV_INDEX diff --git a/src/cli/commands/import/actions.ts b/src/cli/commands/import/actions.ts index 94323e30c..cd93f9734 100644 --- a/src/cli/commands/import/actions.ts +++ b/src/cli/commands/import/actions.ts @@ -383,7 +383,8 @@ export async function handleImport(options: ImportOptions): Promise Date: Thu, 14 May 2026 13:31:35 -0400 Subject: [PATCH 3/4] fix: pin python base image to bookworm for reproducible builds Pin to python:3.12-slim-bookworm to prevent silent OS upgrade when Debian Trixie becomes the default slim tag. Confidence: high Scope-risk: narrow --- .../__tests__/__snapshots__/dockerfile-render.test.ts.snap | 4 ++-- src/assets/container/python/Dockerfile | 2 +- src/cli/commands/import/actions.ts | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap index 05de7d843..ae65334e1 100644 --- a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap +++ b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap @@ -1,7 +1,7 @@ // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html exports[`Dockerfile enableOtel rendering > renders opentelemetry-instrument CMD when enableOtel is true > Dockerfile-enableOtel-true 1`] = ` -"FROM public.ecr.aws/docker/library/python:3.12-slim +"FROM public.ecr.aws/docker/library/python:3.12-slim-bookworm RUN pip install --no-cache-dir uv==0.11.14 @@ -41,7 +41,7 @@ CMD ["opentelemetry-instrument", "python", "-m", "main"] `; exports[`Dockerfile enableOtel rendering > renders plain python CMD when enableOtel is false > Dockerfile-enableOtel-false 1`] = ` -"FROM public.ecr.aws/docker/library/python:3.12-slim +"FROM public.ecr.aws/docker/library/python:3.12-slim-bookworm RUN pip install --no-cache-dir uv==0.11.14 diff --git a/src/assets/container/python/Dockerfile b/src/assets/container/python/Dockerfile index 5047dcc66..913821a06 100644 --- a/src/assets/container/python/Dockerfile +++ b/src/assets/container/python/Dockerfile @@ -1,4 +1,4 @@ -FROM public.ecr.aws/docker/library/python:3.12-slim +FROM public.ecr.aws/docker/library/python:3.12-slim-bookworm RUN pip install --no-cache-dir uv==0.11.14 diff --git a/src/cli/commands/import/actions.ts b/src/cli/commands/import/actions.ts index cd93f9734..6fa8c1775 100644 --- a/src/cli/commands/import/actions.ts +++ b/src/cli/commands/import/actions.ts @@ -383,7 +383,7 @@ export async function handleImport(options: ImportOptions): Promise Date: Thu, 14 May 2026 13:40:53 -0400 Subject: [PATCH 4/4] =?UTF-8?q?fix:=20unpin=20uv=20version=20=E2=80=94=20i?= =?UTF-8?q?nstall=20latest=20via=20pip?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit uv is a single static binary with no OS dependencies, so pinning provides little security value while requiring periodic bumps. Confidence: high Scope-risk: narrow --- docs/container-builds.md | 2 +- .../__tests__/__snapshots__/dockerfile-render.test.ts.snap | 4 ++-- src/assets/container/python/Dockerfile | 2 +- src/cli/commands/import/actions.ts | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/container-builds.md b/docs/container-builds.md index 964b69371..3bca270e2 100644 --- a/docs/container-builds.md +++ b/docs/container-builds.md @@ -40,7 +40,7 @@ app/MyAgent/ ## Generated Dockerfile The template uses `public.ecr.aws/docker/library/python:3.12-slim` as the base image (with `uv` installed via -`pip install uv==0.11.14`) with these design choices: +`pip install uv`) with these design choices: - **Layer caching**: Dependencies (`pyproject.toml`) are installed before copying application code - **Non-root**: Runs as `bedrock_agentcore` (UID 1000) diff --git a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap index ae65334e1..4bc6e9294 100644 --- a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap +++ b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap @@ -3,7 +3,7 @@ exports[`Dockerfile enableOtel rendering > renders opentelemetry-instrument CMD when enableOtel is true > Dockerfile-enableOtel-true 1`] = ` "FROM public.ecr.aws/docker/library/python:3.12-slim-bookworm -RUN pip install --no-cache-dir uv==0.11.14 +RUN pip install --no-cache-dir uv ARG UV_DEFAULT_INDEX ARG UV_INDEX @@ -43,7 +43,7 @@ CMD ["opentelemetry-instrument", "python", "-m", "main"] exports[`Dockerfile enableOtel rendering > renders plain python CMD when enableOtel is false > Dockerfile-enableOtel-false 1`] = ` "FROM public.ecr.aws/docker/library/python:3.12-slim-bookworm -RUN pip install --no-cache-dir uv==0.11.14 +RUN pip install --no-cache-dir uv ARG UV_DEFAULT_INDEX ARG UV_INDEX diff --git a/src/assets/container/python/Dockerfile b/src/assets/container/python/Dockerfile index 913821a06..60a0e87fc 100644 --- a/src/assets/container/python/Dockerfile +++ b/src/assets/container/python/Dockerfile @@ -1,6 +1,6 @@ FROM public.ecr.aws/docker/library/python:3.12-slim-bookworm -RUN pip install --no-cache-dir uv==0.11.14 +RUN pip install --no-cache-dir uv ARG UV_DEFAULT_INDEX ARG UV_INDEX diff --git a/src/cli/commands/import/actions.ts b/src/cli/commands/import/actions.ts index 6fa8c1775..bceefa711 100644 --- a/src/cli/commands/import/actions.ts +++ b/src/cli/commands/import/actions.ts @@ -384,7 +384,7 @@ export async function handleImport(options: ImportOptions): Promise