[precompiled]: remove unused pebble binary from Ubuntu 26.04 base image - #1009
Open
abrarshivani wants to merge 1 commit into
Open
[precompiled]: remove unused pebble binary from Ubuntu 26.04 base image#1009abrarshivani wants to merge 1 commit into
abrarshivani wants to merge 1 commit into
Conversation
tariq1890
reviewed
Sep 11, 2026
The ubuntu:resolute-20260901 base image used for the ubuntu26.04 precompiled driver container ships a pebble binary (/usr/bin/pebble, /var/lib/pebble) that this image never uses. The container's entrypoint is nvidia-driver, and pebble isn't invoked anywhere in the driver install or runtime scripts. pebble is currently affected by CVE-2026-39821. Since it's dead weight in this image, strip it out during the build rather than carrying the CVE exposure forward. Signed-off-by: Abrar Shivani <ashivani@nvidia.com>
abrarshivani
force-pushed
the
remove-pebble-ubuntu26
branch
from
September 11, 2026 23:30
04b33ec to
0e4609e
Compare
tariq1890
reviewed
Sep 12, 2026
Comment on lines
+43
to
+45
| # pebble ships in the base image but is unused here; ENTRYPOINT is nvidia-driver, not pebble. | ||
| # It isn't dpkg-managed (dpkg -S finds no owning package), so apt/dpkg can't remove it - rm is | ||
| # the only option. |
Contributor
There was a problem hiding this comment.
Suggested change
| # pebble ships in the base image but is unused here; ENTRYPOINT is nvidia-driver, not pebble. | |
| # It isn't dpkg-managed (dpkg -S finds no owning package), so apt/dpkg can't remove it - rm is | |
| # the only option. | |
| # pebble ships in the base image but is unused here; ENTRYPOINT is nvidia-driver, not pebble. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The ubuntu:resolute-20260901 base image used for the ubuntu26.04 precompiled
driver container ships a pebble binary (/usr/bin/pebble, /var/lib/pebble)
that this image never uses. The container's entrypoint is nvidia-driver,
and pebble isn't invoked anywhere in the driver install or runtime scripts.
pebble is currently affected by CVE-2026-39821. Since it's dead weight in
this image, strip it out during the build rather than carrying the CVE
exposure forward.
Added a RUN step in ubuntu26.04/precompiled/Dockerfile that removes the
binary and its state directory right after the base package setup.
Verified locally that a build with this change no longer contains any
pebble files.