I don't think we can. They are not built at the same time/ use case: https://github.com/aws/aws-for-fluent-bit/blob/mainline/Makefile#L18-L24

@zhonghui12 what I mean is in the Dockerfile, lines 16, 25, 26 and 28 are installations of yum packages that are "-devel" version.

We don't want those versions of the packages in our production environment.

Could the line 15 to 32 of the Dockerfile be like that ?

RUN yum install -y
glibc
cmake3
gcc
gcc-c++
make
wget
unzip
tar
git
openssl11
cyrus-sasl
pkgconfig
systemd
zlib
ca-certificates
flex
bison \

That way, no -devel packages would be in the Release version. But they will still be there in the Debug version.

@jonathanlebrasseur-qc I believe the devel/developer packages are needed to compile Fluent Bit. They should not be in the final image because we have a multi-stage build where the final stage starts here: https://github.com/aws/aws-for-fluent-bit/blob/mainline/Dockerfile#L100

And then we copy the built binary into it.

My understanding is that the devel packages include the raw header files for dependencies which are needed if you are compiling Fluent Bit from source. At runtime, the devel packages might not be needed.

We may be should remove the devel packages from the final stage: https://github.com/aws/aws-for-fluent-bit/blob/mainline/Dockerfile#L103

Let me try that out...

We don't want those versions of the packages in our production environment.

@jonathanlebrasseur-qc What is your concern with devel packages in prod? I totally agree that if they aren't needed, we shouldn't have the devel versions in our public image. But forgive me if I am very clueless here, does this pose a risk to your prod- is fixing this ASAP something necessary for you to use Fluent Bit?

@PettitWesley The -devel packages are also pulling some dependencies that are sometimes flagged by Inspector as vulnerable. We then need to check if the vulnerabilities have a real impact or not, which consumes time and effort if we need to produce our own image. This is what happened a couple of weeks ago.

It would be better if packages that are not needed are left out of the final image.

The -devel packages are also pulling some dependencies that are sometimes flagged by Inspector as vulnerable.

I see- you're saying that the devel packages give you a lot more than what the non-devel versions have, so you there's a higher surface area for issues to be picked up by the scan. Makes sense. We do ECR image scanning in our release pipeline and if it fails we block the release. So at release time all our images have all their contents validated.

That being said, I think it makes sense to remove the devel packages from the final stage of the build, we have added this to our ops backlog.

Re-opened as the commit resolving this had undetected issues and needs to be reverted.

Given the above-mentioned considerations, this is not an active security risk, though we will still work to root-cause the issue with the fix commit.