Migrate base image to chainguard + python package

[inFocus7]

Context

Migrating from the bookworm base image to a chainguard/wolfi base for reduce CVE impact.

We shouldn't directly use chainguard/python, because it would only support latest pinning for free-tier consumers. This means it could upgrade minor versions under our feet, causing issues. The alternative approach as documented in chainguard docs is to use a wolfi-base with an apk add for languages needed.

CVE Findings

Measured with trivy 0.70.0, --scanners vuln, all package types, arm64 (since that's what I biult natively).

High+: 61 → 1.

• before: 5 CRITICAL + 56 HIGH
• after: 0 CRITICAL + 1 HIGH

The 5 critical CVEs were all stemming from the Debian base: CVE-2023-45853, CVE-2025-7458, CVE-2026-13221, CVE-2026-42496, CVE-2026-8376

The single remaining High+ is CVE-2026-81726 in nltk 3.10.3. A venv dependency without a FixedVersion.

Local Validation

I wasn't sure if we had a thorough test that includes the image (or steps), so I did the below as a minor smoke test (on arm64):

make build-docker-local
docker run -d --name ae -p 8001:8001 -p 4318:4318 soloio/agentevals:local

OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:4318 \
OTEL_RESOURCE_ATTRIBUTES=agentevals.eval_set_id=wolfi-check,agentevals.session_name=wolfi-1 \
  uv run --group e2e python examples/zero-code-examples/langchain/run.py

Output

OTLP endpoint: http://127.0.0.1:4318

[1/3] User: Hi! Can you help me?
Agent: Of course! How can I assist you today?

[2/3] User: Roll a 20-sided die for me
Agent: I rolled a 20-sided die and got a result of 18!

[3/3] User: Is the number you rolled prime?
Agent: The number 18 is not prime.

All traces and logs flushed to OTLP receiver.

curl -s http://127.0.0.1:8001/api/streaming/sessions \
  | jq '.data[] | {sessionId, spanCount, isComplete,
      invocations: [.invocations[] | {userText, agentText,
        tools: [.toolCalls[]?.name]}]}'

Output

{
  "sessionId": "wolfi-1",
  "spanCount": 5,
  "isComplete": true,
  "invocations": [
    {
      "userText": "Hi! Can you help me?",
      "agentText": "Of course! How can I assist you today?",
      "tools": []
    },
    {
      "userText": "Roll a 20-sided die for me",
      "agentText": "I rolled a 20-sided die and got a result of 18!",
      "tools": [
        "roll_die"
      ]
    },
    {
      "userText": "Is the number you rolled prime?",
      "agentText": "The number 18 is not prime.",
      "tools": [
        "check_prime"
      ]
    }
  ]
}

---

This is a draft because I'm not 100% sure what would suffice for validation.

[krisztianfekete]

Thanks, added a few comments!

[krisztianfekete]

Not blocking, just calling this out: :latest plus apk resolution means two builds of this commit a month apart differ, and CI's cache-from: type=gha can pass a PR against a base layer that is weeks old.

Worth a follow-up issue for a scheduled rebuild or a Trivy gate in the docker job.

[inFocus7]

Ah, just refreshed and saw the review comments. Going over them now! 🫡