[ChiragAgg5k]

The published images carry Debian packages behind their security updates and a gosu built with Go 1.24.6. The helm chart reports 222 open high/critical Trivy findings against appwrite/postgres:0.1.0.

• Build gosu 1.20 from its tag with Go 1.27.4 (cross-compiled on the build platform) instead of using the upstream binary, which deliberately stays on Go 1.24.6.
• Debian fixes come from rebuilding on the current postgres:<major> base plus the existing apt-get upgrade. Entrypoint, user and extensions are unchanged.

trivy image --severity HIGH,CRITICAL --ignore-unfixed --scanners vuln, linux/amd64, PG 18:

Package group	0.1.0	0.2.0	this PR
Go stdlib in gosu (v1.24.6)	26	26	0
Debian 13 packages (libheif, perl, util-linux, expat, curl, openssl, pcre2, …)	196	153	0
Total	222	179	0

tests/verify.sh passes for PG 17 and 18 in CI and locally for 18; gosu --version reports 1.20 (go1.27.4 on linux/amd64; gc).

Related: appwrite-labs/cloud#6671

[appwrite]

🟢 Tier S · Ready to merge

The cross-compilation matches the published amd64 and arm64 targets, and the replacement gosu is exercised during the image build.

The Dockerfile now builds gosu 1.20 from source with Go 1.27.4 for the requested target architecture and installs it into the PostgreSQL image. The image then verifies the replacement binary before upgrading and installing its PostgreSQL packages.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 1

File	Change
Dockerfile	Adds a cross-compiled gosu build stage and replaces the base image's gosu before the package upgrade.

---

_{Reviewed e9c36a5 · Details · Comment @appwrite review to re-run, or mention @appwrite with a question.}

[appwrite]

🟢 Tier S · Looks good to merge. Summary