Skip to content

Rebuild etcdctl from source with Go 1.25.10 and patched x/net to remove high-severity CVEs #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

Rebuild etcdctl from source with Go 1.25.10 and patched x/net to remove high-severity CVEs #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e91a127
Initial plan
Copilot May 24, 2026
f69d54c
fix: rebuild etcdctl with patched Go toolchain
Copilot May 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,20 +1,22 @@
FROM dhi.io/debian-base:trixie-debian13-dev AS downloader
FROM golang:1.25.10-bookworm AS builder

ENV ETCD_VERSION="v3.6.11"
ARG ETCD_VERSION="v3.6.11"
ARG TARGETOS
ARG TARGETARCH

RUN apt-get update \
&& apt-get install -y --no-install-recommends ca-certificates curl tar \
&& rm -rf /var/lib/apt/lists/*
WORKDIR /build
RUN git clone --branch "${ETCD_VERSION}" --depth 1 https://github.com/etcd-io/etcd.git .

ARG TARGETARCH
RUN ETCD_URL="https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-${TARGETARCH}.tar.gz" \
&& mkdir -p /out \
&& curl -sL "${ETCD_URL}" | tar -zxv --strip-components=1 -C /out \
&& mv /out/etcdctl /out/etcdctl-bin
WORKDIR /build/etcdctl
RUN --mount=type=cache,target=/go/pkg/mod \
--mount=type=cache,target=/root/.cache/go-build \
go get golang.org/x/net@v0.55.0 golang.org/x/sys@v0.45.0 golang.org/x/text@v0.37.0 \
&& go mod download \
&& CGO_ENABLED=0 GOOS="${TARGETOS:-linux}" GOARCH="${TARGETARCH}" go build -trimpath -ldflags="-s -w" -o /out/etcdctl-bin .

FROM dhi.io/debian-base:trixie

COPY --chmod=755 --from=downloader /out/etcdctl-bin /usr/local/bin/etcdctl-bin
COPY --chmod=755 --from=builder /out/etcdctl-bin /usr/local/bin/etcdctl-bin
COPY --chmod=755 etcdctl-wrapper.sh /usr/local/bin/etcdctl

USER 0
Expand Down
2 changes: 1 addition & 1 deletion Readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,4 +65,4 @@ If neither directory exists (e.g. you attached to a worker), the wrapper runs `e

* [Using etcdctl in k3s clusters](https://docs.k3s.io/advanced?_highlight=etcdctl#using-etcdctl)
* [DHI catalog](https://hub.docker.com/hardened-images/catalog) (base images used in the Dockerfile)
* [etcd releases](https://github.com/etcd-io/etcd/releases): etcd release archives ships all 3 binaries together: `etcd, etcdctl, etcdutl`
* [etcd source releases](https://github.com/etcd-io/etcd/releases): this image builds `etcdctl` from the tagged source during image build