Skip to content

Commit ba6c464

Browse files
authored
[BUZZOK-27808] PDIE Genai agents: Use system pip (#1696)
This drops the uv pip install, preferring to rely on the system installed pip and uv. This is currently to address CVE-2025-8869, which upstream pip has fixed but has not released yet, and its release date is undetermined at this time. Chainguard however has fixed this in their images, so pip installing from pypi is re-introducing the vulnerability into our images. Relying on system pip allows us to use the fixes from Chainguard.
1 parent 0fa97d6 commit ba6c464

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

public_dropin_environments/python311_genai_agents/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ ENV PATH="$VENV_PATH/bin:$PATH" \
4848
# hadolint ignore=SC1091
4949
RUN uv venv ${VENV_PATH} && \
5050
. ${VENV_PATH}/bin/activate && \
51-
uv pip install -U pip setuptools
51+
uv pip install -U setuptools
5252
WORKDIR ${WORKDIR}
5353

5454
COPY ./agent/agent.py ./agent/cgroup_watchers.py ${AGENTDIR}/

public_dropin_environments/python311_genai_agents/Dockerfile.local

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ ENV PATH="$VENV_PATH/bin:$PATH" \
8888
# hadolint ignore=SC1091
8989
RUN uv venv ${VENV_PATH} && \
9090
. ${VENV_PATH}/bin/activate && \
91-
uv pip install -U pip setuptools
91+
uv pip install -U setuptools
9292
WORKDIR ${WORKDIR}
9393

9494
COPY ./agent/agent.py ./agent/cgroup_watchers.py ${AGENTDIR}/

0 commit comments

Comments
 (0)