Background

During review of PR #1178, outdated third-party container images were identified in the Docker Compose configuration. To reduce review scope, this issue tracks upgrading all third-party images in a follow-up PR.

Current Images

Package Deployment (docker-compose.base.yaml)

• rabbitmq:3.9.8 ⚠️ (EOL, has known CVEs)
• mariadb:10-jammy
• redis:7.2.4
• mongo:7.0.1

Presto Deployment (presto-clp/docker-compose.yaml)

• ghcr.io/y-scope/presto/coordinator:dev
• ghcr.io/y-scope/presto/prestissimo-worker:dev

Tasks

• Audit all third-party images for:
  • End-of-life status
  • Known security vulnerabilities (CVEs)
  • Latest stable versions
• Update image versions or make them configurable via environment variables (e.g., ${CLP_QUEUE_IMAGE:-rabbitmq:3.13.8})
• Test the updated images with CLP deployment
• Update documentation if image configuration changes

References

• PR: feat(deployment)!: Migrate package orchestration to Docker Compose (resolves #1177); Temporarily remove support for multi-node deployments. #1178
• Comment: feat(deployment)!: Migrate package orchestration to Docker Compose (resolves #1177); Temporarily remove support for multi-node deployments. #1178 (comment)
• Requested by: @junhaoliao