Re: Add Dockerfile for OSS Scanner

Hi,

On Sat, 17 Oct 2026 at 19:52, Sehrope Sarkuni <sehrope(at)jackdb(dot)com> wrote:
>
> On Fri, Oct 16, 2026 at 11:22 PM Noah Misch <noah(at)leadboat(dot)com> wrote:
> >
> > On 2026-10-08, Anthropic launched its "OSS Scanner"
> > (https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source)
> > The plan is to enroll security(at)postgresql(dot)org for automated notification of
> > vulnerabilities it finds. One of the steps is to provide a Dockerfile that
> > the scanner will use to get a PostgreSQL build. The attached patch adds one
> > to postgresql.git. It mimics CI.
>
> I tried v1 on master (6a2edf2a1e6) using the recipe in the header
> comment and the enroll-postgresql branch. tools/check built it in
> about seven minutes on my 16-core box.
>
> I ran the full suite inside the finished image, without network access,
> as the postgres user:
>
> Ok: 402 Skipped: 24 Fail: 3
>
> The three failures were test_aio 001_aio, 003_initdb, and
> 004_read_stream, all reporting:
>
> FATAL: could not setup io_uring queue: Operation not permitted
>
> Docker's default seccomp profile blocks io_uring. With liburing-dev
> installed, meson enables io_uring support, but the tests fail when they
> attempt to use it.
>
> I removed liburing-dev and added -Dliburing=disabled. All four test_aio
> tests then passed, and the full suite was clean:

Wouldn't removing liburing-dev / setting -Dliburing=disabled also stop
building the io_uring code completely? Since the goal here is to give
the scanner a build with as many optional features as practical,
keeping liburing compiled in seems preferable even if those 3 test_aio
tests cannot run under container seccomp...

If at all there might arise a need for it to trigger all tests in docker
build, we can control io_uring tests with adding something like:

if $ENV{PG_TEST_SKIP_IO_URING} eq 'yes'

Regards,
Ayush