From 0645e10d13e123f7c052ee6cc015ed554c4f4b09 Mon Sep 17 00:00:00 2001 From: Christopher Tabone Date: Thu, 15 Oct 2026 11:32:10 +0000 Subject: [PATCH] Refresh MCP and BLAST runtime images to patched Debian 13 --- blast-jobs/Dockerfile | 8 ++++---- docs/deployment.md | 16 ++++++++++++++++ mcp/Dockerfile | 4 ++-- 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/blast-jobs/Dockerfile b/blast-jobs/Dockerfile index 5ddb414..6f45575 100644 --- a/blast-jobs/Dockerfile +++ b/blast-jobs/Dockerfile @@ -9,10 +9,10 @@ RUN cargo build --release --locked --bin blast-jobs # Versioned path (never LATEST), pinned by SHA-256. NCBI publishes only an MD5 next to the tarball # (bdec166721de3b55f90a3badc83538e8); the SHA-256 below was computed from a download that matched it. -FROM debian:bookworm-slim AS blast +FROM debian:trixie-slim AS blast ARG BLAST_URL=https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/2.17.0/ncbi-blast-2.17.0+-x64-linux.tar.gz ARG BLAST_SHA256=3888112d8207831aa47371d93583c601f058f88b5db22dc782438b039a3a411b -RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/* +RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/* RUN curl -fsSL --retry 3 -o /tmp/blast.tar.gz "$BLAST_URL" \ && echo "$BLAST_SHA256 /tmp/blast.tar.gz" | sha256sum -c - \ && mkdir -p /opt/ncbi-blast/bin \ @@ -22,9 +22,9 @@ RUN curl -fsSL --retry 3 -o /tmp/blast.tar.gz "$BLAST_URL" \ && cp /tmp/ncbi-blast-2.17.0+/LICENSE /opt/ncbi-blast/LICENSE \ && rm -rf /tmp/blast.tar.gz /tmp/ncbi-blast-2.17.0+ -FROM debian:bookworm-slim +FROM debian:trixie-slim # curl for the HEALTHCHECK; libgomp1 is the one shared library BLAST+ needs beyond the base image. -RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl libgomp1 && rm -rf /var/lib/apt/lists/* +RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends ca-certificates curl libgomp1 && rm -rf /var/lib/apt/lists/* COPY --from=blast /opt/ncbi-blast /opt/ncbi-blast ENV PATH=/opt/ncbi-blast/bin:$PATH NCBI_DONT_USE_NCBIRC=1 NCBI_DONT_USE_LOCAL_CONFIG=1 BLAST_USAGE_REPORT=false # A missing shared library or a wrong build fails here, not at the first job. diff --git a/docs/deployment.md b/docs/deployment.md index fb9987f..8f42f69 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -192,3 +192,19 @@ connection URL is never logged with its password. `rmcp` logs one `ERROR` line, "failed to send pending response during drain", each time a client disconnects before its response is written. It is not a server fault; do not alert on it. + +### Runtime security refresh (October 2026) + +The MCP and BLAST job Dockerfiles use Debian 13 (`trixie-slim`) runtimes and +apply available package upgrades during each build. The Rust builder, locked +application dependencies, BLAST+ 2.17.0 checksum, service UIDs, and health checks +remain unchanged. Build with `--pull`, scan the resulting images, and test the +actual runtime against the database and BLAST fixtures before replacing services. +No database migrations are needed for this runtime-only change. + +Retain previous images for rollback. Before replacing BLAST, check its internal +health response for zero queued/running jobs; restarting loses in-memory job +metadata even though the state directory remains mounted. Keep the same state, +configuration, credentials, limits, and read-only database mounts. Validate MCP +initialization/tool discovery, a real read-only tool call, wiki access, and an +end-to-end BLAST search after deployment. Do not restart the main website. diff --git a/mcp/Dockerfile b/mcp/Dockerfile index a1db1ec..bcb1b11 100644 --- a/mcp/Dockerfile +++ b/mcp/Dockerfile @@ -7,8 +7,8 @@ COPY sql ./sql COPY data ./data RUN cargo build --release --locked --bin flybase-mcp -FROM debian:bookworm-slim -RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/* +FROM debian:trixie-slim +RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/* RUN useradd --system --uid 10001 flybase COPY --from=build /src/target/release/flybase-mcp /usr/local/bin/flybase-mcp USER flybase