images/runtime: the Ubuntu base image's /usr/bin/pebble is the only Go 1.26.5 binary left in cilium:v1.20.2 (8 HIGH stdlib CVEs in a binary Cilium never runs) — bump the ubuntu:26.04 digest or drop the binary

Is there an existing issue for this?

• I have searched the existing issues (pebble, ubuntu digest, CVE-2026-33818: none open)

Version

equal or higher than v1.20.0 and lower than v1.21.0

What happened?

quay.io/cilium/cilium:v1.20.2 (built with Go 1.26.8, which cleared the Go 1.26.5 stdlib findings from every Cilium binary) still carries one binary built with Go 1.26.5: /usr/bin/pebble. It comes from the Ubuntu 26.04 base rootfs, is owned by no dpkg package, is not built by anything under images/runtime/, and is never executed by a Cilium pod — but every image scanner counts it, so the agent image reports 8 HIGH stdlib CVEs (CVE-2026-33818, -39821, -46600, -56853, -56858, -56859, -56860, -56862) that are not Cilium's and that a compliance gate cannot tell apart from ones that are.

$ trivy image --severity CRITICAL,HIGH --platform linux/arm64 quay.io/cilium/cilium:v1.20.2
usr/bin/cilium-agent   gobinary  2      # grpc 1.83.1 / x/crypto 0.53.0 — already covered by renovate #48808
usr/bin/cilium-dbg     gobinary  2
usr/bin/hubble         gobinary  1
usr/bin/pebble         gobinary  8      # stdlib go1.26.5 — the Ubuntu base image's pebble
(every other Go binary: 0)

$ docker run --rm --entrypoint sh quay.io/cilium/cilium:v1.20.2 -c 'dpkg -S /usr/bin/pebble; pebble version | head -1'
dpkg-query: no path found matching pattern /usr/bin/pebble
client  v1.32.1
$ go version -m pebble | head -3        # copied out with docker cp
pebble: go1.26.5
	path	github.com/canonical/pebble/cmd/pebble
	mod	github.com/canonical/pebble	v1.32.2-0.20260721212932-7becfc3a9fad

images/runtime/Dockerfile (both v1.20 and main) pins UBUNTU_IMAGE=docker.io/library/ubuntu:26.04@sha256:513c0741… (image created 2026-09-01), which ships that pebble. The current ubuntu:26.04 digest (sha256:cd21a4f6…, created 2026-09-12) ships pebble v1.32.2 rebuilt on a fixed toolchain and scans clean:

$ trivy image --severity CRITICAL,HIGH --platform linux/arm64 ubuntu:26.04
docker.io/library/ubuntu:26.04 (ubuntu 26.04)  ubuntu    0
usr/bin/pebble                                 gobinary  0

Two ways to fix, either is fine:

1. Let Renovate's next chore(deps): update base-images move the ubuntu:26.04 digest (the 09-14 one, #48672, moved only the Go digest) and rebuild cilium-runtime.
2. Durable: rm -f /usr/bin/pebble in images/runtime/install-runtime-deps.sh (or the runtime Dockerfile's rootfs stage), so a base-image toolchain lag never shows up in a Cilium scan again. Nothing in the image references it (grep -rIl pebble / over the image's filesystem returns nothing; /var/lib/pebble is an empty directory), the image has no ENTRYPOINT and its CMD is /usr/bin/cilium-dbg, and the chart's DaemonSet runs cilium-agent.

How can we reproduce the issue?

The commands above, on any host with trivy (0.74.0 here) or grype (0.119.0: same 8 rows, 4 rated High).

Cilium Version

v1.20.2 (quay.io/cilium/cilium:v1.20.2@sha256:2939231d0d3e3ebddcd80fffa168b7ddcc78fdf0dc864d1c8c126ff523c54f01); v1.20.1 has the same pebble.

Kernel Version

Not relevant (image contents); observed on kind nodes on Docker Desktop's 7.0.12-linuxkit kernel, arm64.

Kubernetes Version

Not relevant (image contents); v1.36.4 (kind).

Regression

No — v1.20.1 carried the same binary; it only became visible once 1.20.2's Go 1.26.8 rebuild removed the other 112 stdlib rows.

Sysdump

Not applicable — this is about the image's filesystem, not a running cluster.

Relevant log output

$ jq '.Metadata.ImageConfig.config | {Entrypoint,Cmd}' trivy-cilium-v1.20.2.json
{ "Entrypoint": null, "Cmd": ["/usr/bin/cilium-dbg"] }

Anything else?

Written with AI assistance (Claude, orchestrating the scans and drafting this text) under the Cilium Generative AI policy; every command and number above was run and read by me before posting. The full write-up with the per-binary tables for 1.20.1 and 1.20.2 is public here: https://github.com/ephico2real2/cilium-implementation-poc/blob/main/docs/upstream/cilium-image-scan.md

Cilium Users Document

• Are you a user of Cilium? Please add yourself to the Users doc

Code of Conduct

• I agree to follow this project's Code of Conduct