From 220b3d5067069e08b1760dd39dfb6ef52082a323 Mon Sep 17 00:00:00 2001 From: "Peter A. Jonsson" Date: Fri, 10 Apr 2026 10:02:25 +0200 Subject: [PATCH 1/4] Dockerfile: base everything on same image Building in one image and running in a different image can lead to strange errors, so base them on the same internal base image to ensure that the build image and the result image always come from the same image. --- Dockerfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 196659cf..ae52e88d 100755 --- a/Dockerfile +++ b/Dockerfile @@ -28,7 +28,9 @@ # base installation to speed up build process # https://github.com/davidfrantz/base_image -FROM davidfrantz/base:latest AS force_builder +FROM davidfrantz/base:latest AS internal_base + +FROM internal_base AS force_builder # Environment variables ENV SOURCE_DIR=$HOME/src/force @@ -47,7 +49,7 @@ RUN echo "building FORCE" && \ ./debug.sh $debug && \ make -j$(nproc) $build -FROM davidfrantz/base:latest AS force +FROM internal_base AS force ADD --link --chown=root:root --exclude=.github https://github.com/davidfrantz/force-udf.git /usr/local/bin/force/force-udf COPY --link --chown=root:root --from=force_builder $HOME/src/force/bin /usr/local/bin/force From 77681fbc4517f23fbc89b48a8a56c9a1f93a01c9 Mon Sep 17 00:00:00 2001 From: "Peter A. Jonsson" Date: Fri, 10 Apr 2026 10:08:00 +0200 Subject: [PATCH 2/4] Dockerfile: install build deps Copy the list of build dependencies from base_image and install them in the build container. This will enable removing the build dependencies from base_image, and that will eliminate hundreds of complaints from Trivy, including the current CVE-2026-23112 which is marked as high severity. Refs #415 --- Dockerfile | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/Dockerfile b/Dockerfile index ae52e88d..a8766d28 100755 --- a/Dockerfile +++ b/Dockerfile @@ -39,6 +39,31 @@ ENV SOURCE_DIR=$HOME/src/force ARG debug=disable ARG build=all +# Refresh package list & upgrade existing packages +RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ + --mount=type=cache,target=/var/lib/apt,sharing=locked \ +# Disable interactive frontends. +export DEBIAN_FRONTEND=noninteractive && \ +apt-get -y update && apt-get -y upgrade && \ +# Install required tools. +apt-get -y install --no-install-recommends \ + # speed up building, only effective for local builds + ccache \ + # GCC compiler etc. + build-essential \ + # build requirement for OpenCV/FORCE + pkgconf \ + # Numerical library, dynamically linked in FORCE + libgsl0-dev \ + # JSON parsing, dynamically linked in FORCE + libjansson-dev \ + # force-higher-level UDFs, dynamically linked in FORCE + python3-dev \ + # force-higher-level UDFs, dynamically linked in FORCE + # standalone force-sample-size script + # force-level2-report uses Rmarkdown + r-base + # Copy src to SOURCE_DIR RUN mkdir -p $SOURCE_DIR WORKDIR $SOURCE_DIR From 6c001421127679e8658ed9c205728d10f2ffe03d Mon Sep 17 00:00:00 2001 From: "Peter A. Jonsson" Date: Fri, 10 Apr 2026 10:23:23 +0200 Subject: [PATCH 3/4] Dockerfile: update to latest packages The output from a Docker build might contain outdated Ubuntu packages, so get the latest packages installed. Refs #415 --- Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Dockerfile b/Dockerfile index a8766d28..044e76d1 100755 --- a/Dockerfile +++ b/Dockerfile @@ -30,6 +30,13 @@ # https://github.com/davidfrantz/base_image FROM davidfrantz/base:latest AS internal_base +# Refresh package list & upgrade existing packages +RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ + --mount=type=cache,target=/var/lib/apt,sharing=locked \ +# Disable interactive frontends. +export DEBIAN_FRONTEND=noninteractive && \ +apt-get -y update && apt-get -y upgrade + FROM internal_base AS force_builder # Environment variables From ade4958c297ff024c6d3d532eff2a46a72733f21 Mon Sep 17 00:00:00 2001 From: David Frantz Date: Thu, 28 May 2026 15:53:01 +0200 Subject: [PATCH 4/4] do not attempt to re-install r-base, updated pkgconf comment --- Dockerfile | 8 ++------ misc/force-version.txt | 2 +- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index 044e76d1..9e67ae6f 100755 --- a/Dockerfile +++ b/Dockerfile @@ -58,18 +58,14 @@ apt-get -y install --no-install-recommends \ ccache \ # GCC compiler etc. build-essential \ - # build requirement for OpenCV/FORCE + # needed to find OpenCV pkgconf \ # Numerical library, dynamically linked in FORCE libgsl0-dev \ # JSON parsing, dynamically linked in FORCE libjansson-dev \ # force-higher-level UDFs, dynamically linked in FORCE - python3-dev \ - # force-higher-level UDFs, dynamically linked in FORCE - # standalone force-sample-size script - # force-level2-report uses Rmarkdown - r-base + python3-dev # Copy src to SOURCE_DIR RUN mkdir -p $SOURCE_DIR diff --git a/misc/force-version.txt b/misc/force-version.txt index 67a0efd9..5cee4cd9 100644 --- a/misc/force-version.txt +++ b/misc/force-version.txt @@ -1 +1 @@ -3.10.04-dev:::2026-05-26_13:43:00 +3.10.04-dev:::2026-05-28_13:53:01