rabbitmqadmin removed silently from the last tag...

[lmnogues]

Hi, we are currently using the image rabbitmq:4.2.1-management-alpine (since something like 3 weeks ago)

I've cleared my cache and repull the image today, and the most basic action we were doing on the image is not working anymore

I've tracked the change in a commit, that was repushed on the tag 4.2.1.

dac149a

I believe it should have been a major release and not a silent repush of the image...

[lukebakken]

Major release of ... RabbitMQ? That won't come for ages, and we wanted to address this CVE - #768

You have two workarounds right now:

• Use the -alpine image as a base, install Python yourself, and copy rabbitmqadmin from the rabbitmq_management's priv/www directory already on the image.
• Install a -musl build of rabbitmqadmin-ng from here: https://github.com/rabbitmq/rabbitmqadmin-ng/releases/tag/v2.20.0

I have a TODO to test the above and modify the Alpine images here to include rabbitmqadmin-ng. I'll get to that right now.

[michaelklishin]

@lmnogues this image has no versioning of its own and cannot put out a "major version".

The original rabbitmqadmin was not removed from RabbitMQ but it has been superseded by a new tool, which dac149a has finally adopted.

Well, except for Alpine, as you can see in #780. It can be added back now that rabbitmqadmin v2 has a statically linked MUSL build compatible with Alpine but it won't be exactly the same rabbitmqadmin because the original tool is no longer maintained and is known to plague this image with Python CVEs often enough to be a maintainer headache.

[lukebakken]

@lmnogues please feel free to use this Dockerfile which I just used to test the v2.20.0 musl-based build of rabbitmqadmin-ng.

I'll be opening a PR here soon.

[michaelklishin]

Team RabbitMQ absolutely won't ship a new major over something like this. rabbitmqadmin v1 will be removed in either 4.3 or 4.4, this is to be decided.

[michaelklishin]

#787 adds rabbitmqadmin v2 to the Alpine variant. There are some minor differences in its CLI interface compared to the original version, they are covered in the doc guide.

[lmnogues]

I understand the idea behing the better security and the reduction of cve. What's bother me is that we are using pinned version on all our lib to be sure to be indempotent. But the image is not. Between 2 image pulling we can have dramatic undocumented changes. this feels... pretty wrong.

I know it's not only a "rabbitmq" issue more on the design of docker. May be i'm missing something but i did not fond any communcation on the subject except by going in github looking at the PR...

[michaelklishin]

@lmnogues this image has not had "dramatic undocumented changes" in years. 99% of this image's users do not use rabbitmqadmin that comes with it, and likely do not even know that it is included.

Not only the "dramatic undocumented breaking changes" claim is a significant and insulting exaggeration, you have received a response from key maintainers in mere 3-4 hours and a new version is coming as soon as the image is rebuilt docker-library/official-images#20494.

If you want to be fully in control of what changes go into your images, build your own.

[michaelklishin]

Life of an open source maintainer:

1. Ship a tool that includes a runtime which is a common attack target => get complains about CVEs in said runtime plaguing the image
2. Fundamentally fix those CVEs by introducing a zero dependency version of the tool (after having spent months developing it) => get complaints about "introducing dramatic undocumented changes"

You cannot freaking win.

[lukebakken]

What's bother me is that we are using pinned version on all our lib to be sure to be indempotent. But the image is not

You are correct, it is not. Maybe this is the only image that is cavalier about changes, I don't know. Since you caught this change pretty quickly, I'm assuming you must have tests in place that uncovered the change, so, kudos to you and thank you for reporting it.

Honestly I didn't expect to hear from any Alpine image users about dropping rabbitmqadmin.