Replaced the Docker image base with a distroless image (#296)

* #295: Replace Docker image base with distroless

Switches the runtime stage to gcr.io/distroless/python3-debian13:nonroot,
built from a python:3.13-slim-trixie venv. The final image no longer
ships a shell, package manager, or pip, shrinking the OS-level CVE
surface that recent Docker CVE-fix PRs had to chase. Also adds a
Dependabot docker-ecosystem watch, since distroless removes the
in-image apt-get upgrade patching path.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* #295: Simplify Dockerfile comments

Rewords the distroless-related comments in plainer language
(removes "ABI/path compatibility", "shebangs", etc.).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* #295: Remove venv's bundled pip from the distroless image

`python -m venv` installs its own copy of pip, which vendors its own
copies of msgpack and setuptools carrying known CVEs (GHSA-6v7p-g79w-8964,
CVE-2025-47273) -- the same ones the previous slim-based image's
`pip uninstall -y pip` step addressed. That step didn't carry over to
the distroless rewrite since distroless itself never has pip, but the
venv copied into it still did.

Confirmed via a Trivy scan on a real build (VM with Docker): before this
fix the image carried 2 HIGH findings (msgpack, setuptools); after, 0.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* #295 Shortened changelog record

* #295: Add cooldown to Dependabot docker config

zizmor's dependabot-cooldown audit (run in CI's Audit Workflows job)
flags Dependabot updates without an explicit cooldown as insufficiently
conservative. Set a 7-day default cooldown for the docker ecosystem
entry added in 8ed26ba.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: ahsimb

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

Dockerfile

@@ -1,29 +1,35 @@
-# Use Python base image
-FROM python:3.13-slim AS build
+# Build a virtual environment using the Debian version that matches the
+# distroless image below, so the venv still works once copied over.
+# See https://github.com/GoogleContainerTools/distroless/blob/main/python3/README.md
+FROM python:3.13-slim-trixie AS build
+
+# The distroless image's Python is at /usr/bin/python, but this builder
+# image's Python is at /usr/local/bin/python. Add a matching /usr/bin/python
+# link here so the virtual environment we create points to a path that will
+# also exist in the final image.
+RUN pip install poetry \
+    && ln -s /usr/local/bin/python /usr/bin/python \
+    && /usr/bin/python -m venv /venv
 
-# Install Poetry
-RUN pip install poetry
-
-# Set working directory
 WORKDIR /app
 
 # Copy project files
 COPY pyproject.toml poetry.lock README.rst ./
 COPY exasol/ ./exasol/
 
-# Build and install the wheel
-RUN poetry build
-
-FROM python:3.13-slim
-
+# Build the wheel and install it, with its extras, into the venv. Then
+# remove pip itself: `python -m venv` installs its own copy of pip into
+# the venv, and pip vendors its own copies of other packages (e.g.
+# msgpack, setuptools) that can carry known vulnerabilities.
+RUN poetry build \
+    && WHEEL=$(ls dist/*.whl) \
+    && /venv/bin/pip install --disable-pip-version-check "${WHEEL}[dynamodb,redis,mongodb]" \
+    && /venv/bin/pip uninstall -y pip
+
+# This distroless base image has no shell, no package manager, and no pip.
+FROM gcr.io/distroless/python3-debian13:nonroot
 WORKDIR /app
-COPY --from=build app/dist dist
-
-RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
-
-RUN WHEEL=$(ls dist/*.whl) && pip install "${WHEEL}[dynamodb,redis,mongodb]" \
-    && pip uninstall -y pip
-
+COPY --from=build --chown=nonroot:nonroot /venv /venv
 
 # Set entrypoint
-ENTRYPOINT ["exasol-mcp-server-http"]
+ENTRYPOINT ["/venv/bin/exasol-mcp-server-http"]

doc/changes/unreleased.md

@@ -1,3 +1,7 @@
 # Unreleased
 
 ## Summary
+
+## Security
+
+* #295: Replaced the Docker image's base with `gcr.io/distroless/python3-debian13`.

doc/user_guide/deployment.rst

@@ -59,7 +59,7 @@ Now create and run the Docker container.
         -e EXA_AUTH_BASE_URL=my_mcp_server \
         -e EXA_MCP_SETTINGS=/app/settings.json \
         -v local_path_to_settings.json:/app/settings.json \
-        exadockerci4/exasol-mcp-server:latest
+        exasol/mcp-server:latest
         --port 4896
 
 In this example, the server is configured to use the generic OAuth Proxy provider.