mirror of
https://github.com/milvus-io/milvus.git
synced 2026-07-21 02:05:41 +00:00
Li LiuandGitHub
c819a2c5e1
## What - Upgrade the root, pkg, client, test, and telemetry example modules from Go 1.26.4 to Go 1.26.5. - Upgrade CPU/GPU builder Dockerfiles, macOS CI Go setup, KRTE build arg, rpm setup, meta-migration builder, and go-client test image to Go 1.26.5. - Point CPU and GPU builder consumption in `.env` to the successful build-env tag `20260714-c135601`. ## Why - Latest direct Trivy scan of `milvusdb/milvus:master-20260711-1993feae-amd64` reports CVE-2026-39822 in Go stdlib 1.26.4, fixed in 1.26.5. - The normal daily image scan is currently blocked through Jenkins `milvus_scan_image_daily` #540 with `exec format error`; last successful scan is #508 from 2026-06-10, so this was verified by direct image scan. ## Image coverage - Go toolchain fixes are shared by all Milvus runtime images; no per-OS runtime Dockerfile package change is required. - Builder definitions are updated for CPU ubuntu22.04, ubuntu20.04, ubuntu24.04, amazonlinux2023, rockylinux9 and GPU ubuntu22.04, ubuntu20.04. - No runtime image variant is deliberately skipped; this is not an OS-package CVE. ## Verification - `go.dev/dl/?mode=json&include=all` confirms go1.26.5 is stable and linux amd64/arm64 tarballs exist. - `go env GOTOOLCHAIN GOVERSION` selects `auto` / `go1.26.5` after the module update. - `go list -m` succeeds for root, pkg, client, tests/go_client, and both telemetry examples. - `cd pkg && go test -tags dynamic,test -gcflags="all=-N -l" -count=1 ./util/typeutil` passes after rebasing onto the latest upstream master. - Jenkins build-env #40 succeeded and published builder tag `20260714-c135601`; `.env` now selects that tag for CPU and GPU CI builds. - A repo-wide audit found no remaining Go 1.26.4 toolchain pins. Note: full root `go mod tidy` is not included because this checkout has a root-owned `deployments/docker/dev/volumes/etcd/member` directory that makes `go mod tidy` fail with permission errors; `go mod tidy -e` subsequently OOMed locally. No go.sum changes were produced by the successful module tidies. Generated by autonomous CVE maintenance. --------- Signed-off-by: Li Liu <li.liu@zilliz.com>
56 lines
2.3 KiB
Docker
56 lines
2.3 KiB
Docker
# Copyright (C) 2019-2022 Zilliz. All rights reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed under the License
|
|
# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
|
|
# or implied. See the License for the specific language governing permissions and limitations under the License.
|
|
|
|
FROM amazonlinux:2023
|
|
|
|
ARG TARGETARCH
|
|
|
|
RUN dnf install -y wget g++ gcc gcc-gfortran gdb libatomic libstdc++-static ninja-build git make zip unzip tar which \
|
|
autoconf automake python3 python3-pip perl-FindBin texinfo \
|
|
pkg-config libuuid-devel libaio perl-IPC-Cmd perl-Digest-SHA libasan tzdata && \
|
|
rm -rf /var/cache/yum/*
|
|
|
|
ENV GOPATH /go
|
|
ENV GOROOT /usr/local/go
|
|
ENV GO111MODULE on
|
|
ENV PATH $GOPATH/bin:$GOROOT/bin:$PATH
|
|
RUN mkdir -p /usr/local/go && wget -qO- "https://go.dev/dl/go1.26.5.linux-$TARGETARCH.tar.gz" | tar --strip-components=1 -xz -C /usr/local/go && \
|
|
mkdir -p "$GOPATH/src" "$GOPATH/bin" && \
|
|
go clean --modcache && \
|
|
chmod -R 777 "$GOPATH" && chmod -R a+w $(go env GOTOOLDIR)
|
|
|
|
RUN pip3 install conan==2.25.1
|
|
|
|
RUN echo "target arch $TARGETARCH"
|
|
RUN wget -qO- "https://cmake.org/files/v3.27/cmake-3.27.5-linux-`uname -m`.tar.gz" | tar --strip-components=1 -xz -C /usr/local
|
|
|
|
RUN mkdir /tmp/ccache && cd /tmp/ccache &&\
|
|
wget https://dl.fedoraproject.org/pub/epel/9/Everything/`uname -m`/Packages/h/hiredis-1.0.2-2.el9.`uname -m`.rpm &&\
|
|
wget https://dl.fedoraproject.org/pub/epel/9/Everything/`uname -m`/Packages/c/ccache-4.5.1-2.el9.`uname -m`.rpm &&\
|
|
rpm -i hiredis-1.0.2-2.el9.`uname -m`.rpm ccache-4.5.1-2.el9.`uname -m`.rpm &&\
|
|
rm -rf /tmp/ccache
|
|
|
|
|
|
# refer: https://code.visualstudio.com/docs/remote/containers-advanced#_avoiding-extension-reinstalls-on-container-rebuild
|
|
RUN mkdir -p /home/milvus/.vscode-server/extensions \
|
|
/home/milvus/.vscode-server-insiders/extensions \
|
|
&& chmod -R 777 /home/milvus
|
|
|
|
COPY --chown=0:0 build/docker/builder/entrypoint.sh /
|
|
|
|
RUN curl https://sh.rustup.rs -sSf | \
|
|
sh -s -- --default-toolchain=1.92 -y
|
|
|
|
ENV PATH=/root/.cargo/bin:$PATH
|
|
|
|
ENTRYPOINT [ "/entrypoint.sh" ]
|
|
CMD ["tail", "-f", "/dev/null"]
|