benispeti opened a new issue, #43002: URL: https://github.com/apache/superset/issues/43002
### Bug description ## Issue While performing SBOM/security analysis of the Apache Superset container image, we identified several development packages present in the runtime image. Observed packages: - devlop - libc-dev-bin - libc6-dev - libcrypt-dev - libexpat1-dev - libpython3.11-dev - linux-libc-dev - preact-devtools - python3.11-dev - zlib1g-dev Many of these packages are development-oriented packages that typically provide header files, static libraries, compiler support files, or debugging/developer tooling used during software compilation rather than during runtime execution. ## Why this matters From a security and compliance perspective, development packages in production container images are often flagged because they: - Increase image size - Increase the attack surface - Increase the number of components tracked in SBOMs - Potentially increase the CVE footprint - Make it more difficult to distinguish runtime dependencies from build-time dependencies ## Packages identified ### Linux development packages - libc-dev-bin - libc6-dev - libcrypt-dev - libexpat1-dev - libpython3.11-dev - linux-libc-dev - python3.11-dev - zlib1g-dev These packages appear to provide development headers and build-time artifacts used for compiling native libraries or Python extensions. ### Frontend development tooling - preact-devtools This package appears to be related to frontend development/debugging rather than production runtime functionality. ### Additional package - devlop This package was also identified during the SBOM scan. It is unclear whether it is intended to be present in the final runtime image or whether it is a build-time dependency. ## Request Could the maintainers review whether these packages are required in the production Superset container image? Specifically: - Are these packages intentionally included for runtime functionality? - Are they pulled in as part of the image build process but not actually required at runtime? - Could any of these development packages be excluded from the final image through multi-stage builds or dependency cleanup? If some of these packages are intentionally retained due to packaging requirements, clarification would be helpful for security and compliance reviews. Thank you for your time and for maintaining Apache Superset. ### Screenshots/recordings _No response_ ### Superset version 6.1.0 ### Python version Not applicable ### Node version Not applicable ### Browser Not applicable ### Additional context _No response_ ### Checklist - [x] I have searched Superset docs and Slack and didn't find a solution to my problem. - [x] I have searched the GitHub issue tracker and didn't find a similar bug report. - [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
