Repository navigation
Remove pip and ensurepip from the core and modules runtime images - #482
Open
RobertDWhite wants to merge 2 commits into
Open
RobertDWhite wants to merge 2 commits into
RobertDWhite wants to merge 2 commits into
Conversation
RobertDWhite
marked this pull request as ready for review
October 26, 2026 15:58
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
ostefano
self-requested a review
October 26, 2026 16:01
ostefano
requested changes
Oct 26, 2026
ostefano
left a comment
ostefano
left a comment
Collaborator
There was a problem hiding this comment.
Same thing should apply to 'core'
RobertDWhite
changed the title
ostefano
self-requested a review
October 27, 2026 13:53
ostefano
requested changes
Oct 27, 2026
ostefano
left a comment
ostefano
left a comment
Collaborator
There was a problem hiding this comment.
Thank you, I believe also misp-guard would benefit from this (sorry, just forgot it in my previous message)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The modules runtime retains pip's vendored dependencies after wheel installation. Updating application requirements does not update those separate copies. Remove pip after installation and remove ensurepip, including its bundled pip wheel; keep installation tooling in the build stage.
Validation: applied the same cleanup to the immutable v3.1.1 amd64 image in an isolated container with no network access, credentials, or persistent storage. Confirmed pip and ensurepip are absent, dropped to UID 1001, started misp-modules, listed all 252 modules, and verified HTML-to-Markdown conversion preserves text while removing script content. The disposable check exited successfully.
The upstream Docker build workflow passed, including the full and slim modules images. The workflow uses push:false and does not publish a deployable image. This remains a draft pending final-image scanning and broader module tests. Custom modules that install packages dynamically at runtime would need to install those dependencies during image construction instead. No application dependencies or base image are changed.
Per review, the same cleanup now also applies to the core image: pip and ensurepip are removed right after the wheel install in the final stage. Neither the core entrypoint/config scripts nor the MISP application invoke pip at runtime.