Security: operator Docker image uses python:3.12 (full) shipping 133 CRITICAL CVEs

[tmvfb]

Summary

The operator Dockerfile uses python:3.12 (the full Debian image) as its base. This causes the published ghcr.io/dask/dask-kubernetes-operator image to ship a large set of Debian packages that have no relevance to a Kubernetes operator — most notably ImageMagick and its associated libraries.

When scanned with Trivy, the 2026.3.0 image reports 133 CRITICAL vulnerabilities, the overwhelming majority of which come from these unnecessary packages.

Summary from AI:

Root cause

python:3.12 (full) installs a broad Debian package set that includes:

• imagemagick, libmagickcore-*, libmagickwand-* (~8 CVEs × ~15 package variants = ~120 CRITICAL CVEs)
• libraw (3 CRITICAL CVEs, no fix available)
• libopenexr (2 CRITICAL CVEs, no fix available)
• libmariadb-dev, mariadb-common (1 CRITICAL CVE)
• libunbound (2 CRITICAL CVEs, no fix available)
• libgnutls (2 CRITICAL CVEs, fixable)
• openssl (1 CRITICAL CVE, fixable)

None of these are needed by the operator. The operator's actual Python dependencies (kopf, kr8s, kubernetes, kubernetes-asyncio, distributed, dask, pykube-ng, rich) are all pure Python and install cleanly on python:3.12-slim.

Proposed fix

Change both stages in dask_kubernetes/operator/deployment/Dockerfile from:

FROM python:3.12 as builder
...
FROM python:3.12

to:

FROM python:3.12-slim as builder
...
FROM python:3.12-slim

This single change would eliminate ~130 of the 133 CRITICAL CVEs from the published image.

Verification

The operator has no native-extension dependencies that would require system libraries beyond what python:3.12-slim provides. The pip install of the wheel succeeds on slim without any additional apt-get installs.

Impact

Any cluster running the dask-kubernetes operator will report a large number of CRITICAL security findings from automated scanners (Trivy, Grype, etc.), making it difficult to distinguish real operational risk from inherited base-image noise. The operator itself is not exposed to the attack surface of ImageMagick or libraw — but the CVE count creates compliance burden for users.

[tmvfb]

For context: I see #967 recently bumped the base from python:3.10 to python:3.12 (merged Jan 7, 2026). That PR focused on the Python version bump for pickle compatibility (#966) — the full vs slim distinction wasn't part of the discussion.

Worth clarifying the distinction between the operator and workers:

• Workers run user code, may need numpy, pandas, etc. — full image or a custom image makes sense there.
• The operator just runs kopf watching Kubernetes CRDs. Its actual dependencies (kopf, kr8s, kubernetes, distributed, pykube-ng, rich) are all pure Python. It never needs ImageMagick, libraw, libmariadb, or libopenexr.

So python:3.12-slim is the right base specifically for the operator image in dask_kubernetes/operator/deployment/Dockerfile. Worker images are a separate concern and unaffected by this change.