I have searched the existing issues and discussions.
Problem Description
Openwebui currently uses python3.11-slim-bookworm as the base image which brings with itself quite a lot of vulnerabilities. Is there any plan on fixing these?
Can we possibly move to a better base image or maybe move to a distroless image. I would be glad to help you out here.
Alternatives Considered
No response
Additional Context
No response
Originally created by @thenicekat on GitHub (Apr 1, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/12284
### Check Existing Issues
- [x] I have searched the existing issues and discussions.
### Problem Description
Openwebui currently uses python3.11-slim-bookworm as the base image which brings with itself quite a lot of vulnerabilities. Is there any plan on fixing these?
Ref: https://hub.docker.com/layers/library/python/3.11-slim-bookworm/images/sha256-55a4707a91d43b6397215a57b818d2822e66c27fd973bb82eb71b7512c15a4da
### Desired Solution you'd like
Can we possibly move to a better base image or maybe move to a distroless image. I would be glad to help you out here.
### Alternatives Considered
_No response_
### Additional Context
_No response_
@thenicekat If you add the platform filter, you will see it only has 1 critical CVE. The image for py3.12 has none.
<!-- gh-comment-id:2780747507 -->
@gaby commented on GitHub (Apr 5, 2025):
@thenicekat If you add the platform filter, you will see it only has 1 critical CVE. The image for py3.12 has none.
Distroless doesnt have things like a shell, which Open-WebUI relies on. It would also not allow users to exec into the container.
<!-- gh-comment-id:2780748733 -->
@gaby commented on GitHub (Apr 5, 2025):
Distroless doesnt have things like a shell, which Open-WebUI relies on. It would also not allow users to exec into the container.
@tjbck I can submit a PR to bump the Docker base image to python3.12-slim-bookworm if that's OK with you. It will solve several of these issues from the base image.
<!-- gh-comment-id:2781691453 -->
@gaby commented on GitHub (Apr 6, 2025):
@tjbck I can submit a PR to bump the Docker base image to `python3.12-slim-bookworm` if that's OK with you. It will solve several of these issues from the base image.
<!-- gh-comment-id:2848143292 -->
@Azzeo commented on GitHub (May 2, 2025):
This PR was reverted:
> reverting due to arm64/linux cuda build failure.
Can this be looked at again?
@tjbck can we open this issue atleast to keep track of upgrading the base image?
<!-- gh-comment-id:2853360298 -->
@thenicekat commented on GitHub (May 6, 2025):
@tjbck can we open this issue atleast to keep track of upgrading the base image?
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @thenicekat on GitHub (Apr 1, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/12284
Check Existing Issues
Problem Description
Openwebui currently uses python3.11-slim-bookworm as the base image which brings with itself quite a lot of vulnerabilities. Is there any plan on fixing these?
Ref: https://hub.docker.com/layers/library/python/3.11-slim-bookworm/images/sha256-55a4707a91d43b6397215a57b818d2822e66c27fd973bb82eb71b7512c15a4da
Desired Solution you'd like
Can we possibly move to a better base image or maybe move to a distroless image. I would be glad to help you out here.
Alternatives Considered
No response
Additional Context
No response
@gaby commented on GitHub (Apr 5, 2025):
@thenicekat If you add the platform filter, you will see it only has 1 critical CVE. The image for py3.12 has none.
@gaby commented on GitHub (Apr 5, 2025):
Distroless doesnt have things like a shell, which Open-WebUI relies on. It would also not allow users to exec into the container.
@gaby commented on GitHub (Apr 6, 2025):
@tjbck I can submit a PR to bump the Docker base image to
python3.12-slim-bookwormif that's OK with you. It will solve several of these issues from the base image.@tjbck commented on GitHub (Apr 6, 2025):
3.12 should also work out of the box, PR welcome!
@gaby commented on GitHub (Apr 6, 2025):
PR submitted.
@thenicekat commented on GitHub (Apr 7, 2025):
Thank you.
@Azzeo commented on GitHub (May 2, 2025):
This PR was reverted:
Can this be looked at again?
@thenicekat commented on GitHub (May 6, 2025):
@tjbck can we open this issue atleast to keep track of upgrading the base image?