From 54d0b69ec92559b620ee99becc842b06b064f98f Mon Sep 17 00:00:00 2001 From: Robert Date: Mon, 26 Oct 2026 10:11:39 -0400 Subject: [PATCH 1/3] Remove pip and ensurepip from modules runtime image --- modules/Dockerfile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/Dockerfile b/modules/Dockerfile index 1a38a39c..1ef2374f 100644 --- a/modules/Dockerfile +++ b/modules/Dockerfile @@ -83,6 +83,11 @@ RUN groupadd -g "${MISP_GID}" misp && \ RUN --mount=type=bind,from=python-build,source=/wheels,target=/wheels \ pip install --no-cache-dir /wheels/*.whl +# Installation is complete. Keep pip and its vendored dependencies out of the +# runtime, including the bundled wheel that could reinstall them via ensurepip. +RUN python -m pip uninstall --yes pip && \ + python -c 'import pathlib, shutil, sysconfig; shutil.rmtree(pathlib.Path(sysconfig.get_path("stdlib")) / "ensurepip")' + RUN bash -c 'mkdir -p /custom/{action_mod,expansion,export_mod,import_mod} && chown -R misp:misp /custom' USER misp From 92e4f9e74e78c875a9b3ac8b9ecd1b0cda3390cf Mon Sep 17 00:00:00 2001 From: Robert Date: Mon, 26 Oct 2026 14:02:31 -0400 Subject: [PATCH 2/3] Remove pip and ensurepip from core runtime image --- core/Dockerfile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/Dockerfile b/core/Dockerfile index 03576d7c..ca158fde 100644 --- a/core/Dockerfile +++ b/core/Dockerfile @@ -300,6 +300,12 @@ RUN apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/* # shipped in everything we publish. A bind mount is never committed to a layer. RUN --mount=type=bind,from=python-build,source=/wheels,target=/wheels \ pip install --no-cache-dir /wheels/*.whl + +# Installation is complete. Keep pip and its vendored dependencies out of the +# runtime, including the bundled wheel that could reinstall them via ensurepip. +RUN python -m pip uninstall --yes pip && \ + python -c 'import pathlib, shutil, sysconfig; shutil.rmtree(pathlib.Path(sysconfig.get_path("stdlib")) / "ensurepip")' + # PHP: install prebuilt libraries, then install the app's PHP deps COPY --from=php-build /pecl_libs.tar.gz / RUN tar -xzf /pecl_libs.tar.gz && rm /pecl_libs.tar.gz From 8cd721cbcc8dce8607c28bceb64e24fa1099d090 Mon Sep 17 00:00:00 2001 From: Robert Date: Thu, 29 Oct 2026 21:31:33 -0400 Subject: [PATCH 3/3] Remove pip and ensurepip from misp-guard runtime image --- guard/Dockerfile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/guard/Dockerfile b/guard/Dockerfile index 128fec2e..eb354d01 100644 --- a/guard/Dockerfile +++ b/guard/Dockerfile @@ -41,6 +41,11 @@ EOF RUN --mount=type=bind,from=python-build,source=/wheels,target=/wheels \ pip install --no-cache-dir /wheels/*.whl + # Installation is complete. Keep pip and its vendored dependencies out of the + # runtime, including the bundled wheel that could reinstall them via ensurepip. + RUN python -m pip uninstall --yes pip && \ + python -c 'import pathlib, shutil, sysconfig; shutil.rmtree(pathlib.Path(sysconfig.get_path("stdlib")) / "ensurepip")' + COPY --from=python-build /srv /srv COPY files/ /