Remove slim flavour and docker hub deps

.github/workflows/release-latest.yml

@@ -11,7 +11,7 @@ jobs:
 
     strategy:
       matrix:
-        target: [misp-core, misp-modules, misp-core-slim, misp-modules-slim, misp-guard, misp-nginx]
+        target: [misp-core, misp-modules, misp-guard, misp-nginx]
 
     permissions:
       contents: write
@@ -38,13 +38,7 @@ jobs:
           echo "COMMIT_HASH=$COMMIT_HASH" >> "$GITHUB_ENV"
           OWNER=$(echo "$GITHUB_REPOSITORY_OWNER" | tr '[:upper:]' '[:lower:]')
           echo "NAMESPACE=ghcr.io/${OWNER}/misp-docker" >> "$GITHUB_ENV"
-          TARGET="${{ matrix.target }}"
-          TAG="${COMMIT_HASH}"
-          if [[ "$TARGET" == *"-slim" ]]; then
-            TARGET="${TARGET%-slim}"
-            TAG="${TAG}-slim"
-          fi
-          echo "IMAGE=ghcr.io/${OWNER}/misp-docker/${TARGET}:${TAG}" >> "$GITHUB_ENV"
+          echo "IMAGE=ghcr.io/${OWNER}/misp-docker/${{ matrix.target }}:${COMMIT_HASH}" >> "$GITHUB_ENV"
 
       - name: Log in to the container registry
         uses: docker/login-action@v4
@@ -63,7 +57,6 @@ jobs:
           targets: ${{ matrix.target }}
 
       - name: Generate SBOM
-        if: ${{ !contains(matrix.target, '-slim') }}
         uses: anchore/sbom-action@v0
         with:
           image: ${{ env.IMAGE }}
@@ -76,7 +69,6 @@ jobs:
           upload-artifact: false
 
       - name: Upload SBOM artifact
-        if: ${{ !contains(matrix.target, '-slim') }}
         uses: actions/upload-artifact@v7
         with:
           name: sbom-${{ matrix.target }}

.github/workflows/test-build-latest.yml

@@ -10,7 +10,7 @@ jobs:
 
     strategy:
       matrix:
-        target: [misp-core, misp-modules, misp-core-slim, misp-modules-slim, misp-guard, misp-nginx]
+        target: [misp-core, misp-modules, misp-guard, misp-nginx]
 
     steps:
       - name: Checkout repository

Makefile

@@ -1,6 +1,6 @@
 .DEFAULT_GOAL := help
 
-.PHONY: help build build-core build-nginx build-modules build-guard build-slim bake up down logs shellcheck clean prune
+.PHONY: help build build-core build-nginx build-modules build-guard bake up down logs shellcheck clean prune
 
 help:
 	@echo "Usage: make <target>"
@@ -11,7 +11,6 @@ help:
 	@echo "  build-nginx    Build misp-nginx only"
 	@echo "  build-modules  Build misp-modules only"
 	@echo "  build-guard    Build misp-guard only"
-	@echo "  build-slim     Build all slim variant images"
 	@echo "  bake           Build all images via docker buildx bake"
 	@echo ""
 	@echo "Runtime targets:"
@@ -39,9 +38,6 @@ build-modules:
 build-guard:
 	docker compose build misp-guard
 
-build-slim:
-	docker compose build --build-arg CORE_FLAVOR=slim --build-arg MODULES_FLAVOR=slim
-
 bake:
 	docker buildx bake
 

README.md

@@ -367,7 +367,6 @@ CUSTOM_AUTH_CUSTOM_LOGOUT=
   - `./files`: `/var/www/MISP/app/files/`
   - `./gnupg`: `/var/www/MISP/.gnupg/`
 - If you need to automatically run additional steps each time the container starts, create a new file `files/customize_misp.sh`, and replace the variable `${CUSTOM_PATH}` inside `docker-compose.yml` with its parent path.
-- If you are interested in running streamlined versions of the images (fewer dependencies, easier approval from compliance), you might want to use the `latest-slim` tag. Just adjust the `docker-compose.yml` file, and run again `docker compose pull` and `docker compose up`.
 
 #### Breaking changes
 
@@ -450,24 +449,7 @@ sed -e '/^[[:space:]]*$/d' -e '/[#@]/d' -e 's/\"//g' -e 's/\(^[^=]*\)=\(.*\)/\1=
 docker buildx bake -f docker-bake.hcl -f env.hcl --provenance false debian
 ```
 
-This builds `misp-core`, `misp-modules`, and `misp-guard` with all features included.
-
-**Build slim images:**
-
-```bash
-export NAMESPACE=local
-export COMMIT_HASH=`git rev-parse --short HEAD`
-sed -e '/^[[:space:]]*$/d' -e '/[#@]/d' -e 's/\"//g' -e 's/\(^[^=]*\)=\(.*\)/\1="\2"/' template.env > env.hcl
-docker buildx bake -f docker-bake.hcl -f env.hcl --provenance false debian-slim
-```
-
-This builds lightweight versions of `misp-core-slim`, `misp-modules-slim`, and `misp-guard` with reduced dependencies.
-
-**Available bake targets:**
-
-- `standard` - Full-featured images (misp-core, misp-modules, misp-guard)
-- `slim` - Lightweight images (misp-core-slim, misp-modules-slim, misp-guard)
-- `default` - Builds all variants (both standard and slim)
+This builds `misp-core`, `misp-modules`, `misp-nginx`, and `misp-guard`.
 
 **Note:** The (GNU) `sed` command converts `template.env` to `env.hcl` format by removing empty lines, comments, and properly formatting variables for the bake file (on OSX you should install `gsed`).
 

core/Dockerfile

@@ -5,7 +5,6 @@ FROM "${DOCKER_HUB_PROXY}python:3.14-slim-trixie" AS php-base
 
 ARG CORE_TAG
 ARG CORE_COMMIT
-ARG CORE_FLAVOR
 ARG PHP_API_VERSION
 RUN : "${PHP_API_VERSION:?Build argument PHP_API_VERSION is required and cannot be empty.}"
 ARG PHP_PACKAGE_VERSION
@@ -20,77 +19,46 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 RUN <<-EOF
     apt-get update
-
-    if [ "${CORE_FLAVOR}" = "slim" ]; then
-        apt-get install -y --no-install-recommends \
-            lsb-release \
-            ca-certificates \
-            tini \
-            gettext \
-            procps \
-            sudo \
-            openssl \
-            gpg \
-            gpg-agent \
-            mariadb-client \
-            rsync \
-            rsyslog \
-            php${PHP_PACKAGE_VERSION} \
-            php${PHP_PACKAGE_VERSION}-curl \
-            php${PHP_PACKAGE_VERSION}-xml \
-            php${PHP_PACKAGE_VERSION}-mbstring \
-            php${PHP_PACKAGE_VERSION}-mysql \
-            php${PHP_PACKAGE_VERSION}-redis \
-            php${PHP_PACKAGE_VERSION}-gd \
-            php${PHP_PACKAGE_VERSION}-fpm \
-            php${PHP_PACKAGE_VERSION}-zip \
-            unzip \
-            zip \
-            curl \
-            uuid-runtime \
-            jq
-    else
-        apt-get install -y --no-install-recommends \
-            lsb-release \
-            ca-certificates \
-            tini \
-            gettext \
-            procps \
-            sudo \
-            openssl \
-            gpg \
-            gpg-agent \
-            mariadb-client \
-            rsync \
-            rsyslog \
-            php${PHP_PACKAGE_VERSION} \
-            php${PHP_PACKAGE_VERSION}-apcu \
-            php${PHP_PACKAGE_VERSION}-curl \
-            php${PHP_PACKAGE_VERSION}-xml \
-            php${PHP_PACKAGE_VERSION}-intl \
-            php${PHP_PACKAGE_VERSION}-bcmath \
-            php${PHP_PACKAGE_VERSION}-mbstring \
-            php${PHP_PACKAGE_VERSION}-mysql \
-            php${PHP_PACKAGE_VERSION}-redis \
-            php${PHP_PACKAGE_VERSION}-gd \
-            php${PHP_PACKAGE_VERSION}-fpm \
-            php${PHP_PACKAGE_VERSION}-zip \
-            php${PHP_PACKAGE_VERSION}-ldap \
-            libmagic1 \
-            libldap-common \
-            librdkafka1 \
-            libbrotli1 \
-            libsimdjson25 \
-            libzstd1 \
-            ssdeep \
-            stunnel4 \
-            libfuzzy2 \
-            unzip \
-            zip \
-            curl \
-            uuid-runtime \
-            jq
-    fi
+    apt-get install -y --no-install-recommends \
+        lsb-release \
+        ca-certificates \
+        tini \
+        gettext \
+        procps \
+        sudo \
+        openssl \
+        gpg \
+        gpg-agent \
+        mariadb-client \
+        rsync \
+        rsyslog \
+        php${PHP_PACKAGE_VERSION} \
+        php${PHP_PACKAGE_VERSION}-apcu \
+        php${PHP_PACKAGE_VERSION}-curl \
+        php${PHP_PACKAGE_VERSION}-xml \
+        php${PHP_PACKAGE_VERSION}-intl \
+        php${PHP_PACKAGE_VERSION}-bcmath \
+        php${PHP_PACKAGE_VERSION}-mbstring \
+        php${PHP_PACKAGE_VERSION}-mysql \
+        php${PHP_PACKAGE_VERSION}-redis \
+        php${PHP_PACKAGE_VERSION}-gd \
+        php${PHP_PACKAGE_VERSION}-fpm \
+        php${PHP_PACKAGE_VERSION}-zip \
+        php${PHP_PACKAGE_VERSION}-ldap \
+        libmagic1 \
+        libldap-common \
+        librdkafka1 \
+        libbrotli1 \
+        libsimdjson25 \
+        libzstd1 \
+        ssdeep \
+        stunnel4 \
+        libfuzzy2 \
+        unzip \
+        zip \
+        curl \
+        uuid-runtime \
+        jq
 EOF
 
 # --- composer-build
@@ -101,7 +69,6 @@ WORKDIR /tmp
 ENV COMPOSER_ALLOW_SUPERUSER=1
 ARG CORE_TAG
 ARG CORE_COMMIT
-ARG CORE_FLAVOR
 
 # prepare composer.json
 RUN curl -o /tmp/composer.json https://raw.githubusercontent.com/MISP/MISP/${CORE_COMMIT:-${CORE_TAG}}/app/composer.json && \
@@ -115,17 +82,12 @@ COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
 RUN <<-EOF
     composer config --no-interaction allow-plugins.composer/installers true
     composer install
-
-    if [ "${CORE_FLAVOR}" = "slim" ]; then
-        :
-    else
-        composer require --with-all-dependencies --no-interaction \
-            elasticsearch/elasticsearch:^8.7.0 \
-            jakub-onderka/openid-connect-php:^1.0.0 \
-            certmichelin/openid-connect-php:1.3.0 \
-            phpseclib/phpseclib:^3.0.47 \
-            aws/aws-sdk-php
-    fi
+    composer require --with-all-dependencies --no-interaction \
+        elasticsearch/elasticsearch:^8.7.0 \
+        jakub-onderka/openid-connect-php:^1.0.0 \
+        certmichelin/openid-connect-php:1.3.0 \
+        phpseclib/phpseclib:^3.0.47 \
+        aws/aws-sdk-php
 EOF
 
 # --- php-build
@@ -135,33 +97,22 @@ FROM php-base AS php-build
 ENV TZ=Etc/UTC
 ARG CORE_TAG
 ARG CORE_COMMIT
-ARG CORE_FLAVOR
 ARG PHP_API_VERSION
 ARG PHP_PACKAGE_VERSION
 
 RUN <<-EOF
-    if [ "${CORE_FLAVOR}" = "slim" ]; then
-        apt-get install -y --no-install-recommends \
-            gcc \
-            g++ \
-            git \
-            make \
-            php${PHP_PACKAGE_VERSION}-dev \
-            php-pear
-    else
-        apt-get install -y --no-install-recommends \
-            gcc \
-            g++ \
-            git \
-            make \
-            php${PHP_PACKAGE_VERSION}-dev \
-            php-pear \
-            libbrotli-dev \
-            libfuzzy-dev \
-            librdkafka-dev \
-            libsimdjson-dev \
-            libzstd-dev
-    fi
+    apt-get install -y --no-install-recommends \
+        gcc \
+        g++ \
+        git \
+        make \
+        php${PHP_PACKAGE_VERSION}-dev \
+        php-pear \
+        libbrotli-dev \
+        libfuzzy-dev \
+        librdkafka-dev \
+        libsimdjson-dev \
+        libzstd-dev
     apt-get autoremove -y && apt-get clean -y && rm -rf /var/lib/apt/lists/*
 EOF
 
@@ -171,31 +122,26 @@ RUN update-alternatives --set php /usr/bin/php${PHP_PACKAGE_VERSION} && \
     update-alternatives --set phpize /usr/bin/phpize${PHP_PACKAGE_VERSION}
 
 RUN --mount=type=bind,from=ghcr.io/php/pie:bin,source=/pie,target=/usr/local/bin/pie <<-EOF
-    if [ "${CORE_FLAVOR}" = "slim" ]; then
-        tar -czf /pecl_libs.tar.gz -T /dev/null
-    else
-        cp "/usr/lib/$(gcc -dumpmachine)"/libfuzzy.* /usr/lib
-        pie install --no-cache \
-            rdkafka/rdkafka \
-            kjdev/zstd \
-            kjdev/brotli \
-            awesome/simdjson_plus
-        git clone --recursive --depth=1 https://github.com/JakubOnderka/pecl-text-ssdeep.git /tmp/pecl-text-ssdeep
-        cd /tmp/pecl-text-ssdeep && phpize && ./configure && make && make install
-        tar -czf /pecl_libs.tar.gz \
-            /usr/lib/php/${PHP_API_VERSION}/ssdeep.so \
-            /usr/lib/php/${PHP_API_VERSION}/rdkafka.so \
-            /usr/lib/php/${PHP_API_VERSION}/brotli.so \
-            /usr/lib/php/${PHP_API_VERSION}/simdjson_plus.so \
-            /usr/lib/php/${PHP_API_VERSION}/zstd.so
-    fi
+    cp "/usr/lib/$(gcc -dumpmachine)"/libfuzzy.* /usr/lib
+    pie install --no-cache \
+        rdkafka/rdkafka \
+        kjdev/zstd \
+        kjdev/brotli \
+        awesome/simdjson_plus
+    git clone --recursive --depth=1 https://github.com/JakubOnderka/pecl-text-ssdeep.git /tmp/pecl-text-ssdeep
+    cd /tmp/pecl-text-ssdeep && phpize && ./configure && make && make install
+    tar -czf /pecl_libs.tar.gz \
+        /usr/lib/php/${PHP_API_VERSION}/ssdeep.so \
+        /usr/lib/php/${PHP_API_VERSION}/rdkafka.so \
+        /usr/lib/php/${PHP_API_VERSION}/brotli.so \
+        /usr/lib/php/${PHP_API_VERSION}/simdjson_plus.so \
+        /usr/lib/php/${PHP_API_VERSION}/zstd.so
 EOF
 
 # --- python-build
 FROM php-base AS python-build
 ARG CORE_TAG
 ARG CORE_COMMIT
-ARG CORE_FLAVOR
 
 RUN apt-get install -y --no-install-recommends \
     gcc \
@@ -281,7 +227,6 @@ EOF
 FROM php-base
 ARG CORE_TAG
 ARG CORE_COMMIT
-ARG CORE_FLAVOR
 ARG PHP_PACKAGE_VERSION
 
 ENV PATH="/var/www/MISP/app/Console:${PATH}"
@@ -319,11 +264,7 @@ COPY --from=composer-build --chown=www-data:www-data --chmod=0550 /tmp/Vendor /v
 
 # Gather these in one layer, only act on actual directories under /etc/php/
 RUN <<-EOF
-    if [ "${CORE_FLAVOR}" = "slim" ]; then
-        set --
-    else
-        set -- "ssdeep" "rdkafka" "brotli" "simdjson_plus" "zstd"
-    fi
+    set -- "ssdeep" "rdkafka" "brotli" "simdjson_plus" "zstd"
     for mod in "$@"; do
         for dir in /etc/php/*/; do
             echo "extension=${mod}.so" > "${dir}mods-available/${mod}.ini"