docker pull golang:1.27golang@sha256:2920bb124f1a2e12a1d39f0cab756ae0068441ee1da7655dec7f5e374944095bSize per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 7 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 49 MB
# debian.sh --arch 'amd64' out/ 'trixie' '@1793059200' - 26 MB
RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends ca-certificates curl gnupg netbase sq wget ; apt-get dist-clean # buildkit - 68 MB
RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends git mercurial openssh-client subversion procps ; apt-get dist-clean # buildkit - 102 MB
RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends g++ gcc libc6-dev make pkg-config ; dpkgArch="$(dpkg --print-architecture)"; if [ "$dpkgArch" = 'arm64' ]; then apt-get install -y --no-install-recommends binutils-gold; fi; rm -rf /var/lib/apt/lists/* # buildkit - 71 MB
COPY /target/ / # buildkit - 127 B
RUN /bin/sh -c mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 1777 "$GOPATH" # buildkit - 32 B
WORKDIR /go
Known vulnerabilities
2Critical0 with a fix
151High0 with a fix
886Medium0 with a fix
1012Low0 with a fix
7Unknown0 with a fix
2058 findings across 217 packages; 0 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| Critical | CVE-2026-60002openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side | openssh-clientinstalled 1:10.0p1-7+deb13u4 | no fix yet |
| Critical | CVE-2026-99083kernel: ksmbd: fix heap out-of-bounds write in krb5_authenticate() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2013-7445kernel: memory exhaustion via crafted Graphics Execution Manager (GEM) objects | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2019-19449kernel: mounting a crafted f2fs filesystem image can lead to slab-out-of-bounds read access in f2fs_build_segment_manager in fs/f2fs/segment | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2019-19814kernel: out-of-bounds write in __remove_dirty_segment in fs/f2fs/segment.c | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2021-3847kernel: low-privileged user privileges escalation | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2021-3864kernel: descendant's dumpable setting with certain SUID binaries | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2024-21803kernel: bluetooth: use-after-free vulnerability in af_bluetooth.c | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2024-58015kernel: wifi: ath12k: Fix for out-of bound access error | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38137kernel: PCI/pwrctrl: Cancel outstanding rescan work when unregistering | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38187kernel: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38421kernel: platform/x86/amd: pmf: Use device managed allocations | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-38636kernel: rv: Use strings in da monitors tracepoints | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-39859kernel: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-39862kernel: wifi: mt76: mt7915: fix list corruption after hardware restart | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-39958kernel: iommu/s390: Make attach succeed when the device was surprise removed | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-40025kernel: f2fs: fix to do sanity check on node footer for non inode dnode | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-68174kernel: Linux kernel AMD KFD: Race condition causes system crash | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-68735kernel: Kernel: Privilege escalation via use-after-free in drm/panthor | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2025-69720ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. | libncursesw6, libtinfo6, ncurses-base, ncurses-bininstalled 6.5+20250216-2 | no fix yet |
| High | CVE-2026-100072kernel: ACPI: platform: Use acpi_bus_get_primary_device() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-106553openssh: OpenSSH: Credential disclosure via failed GSSAPI authentication | openssh-clientinstalled 1:10.0p1-7+deb13u4 | no fix yet |
| High | CVE-2026-106555openssh: OpenSSH: Information disclosure via GSSAPI authentication state persistence | openssh-clientinstalled 1:10.0p1-7+deb13u4 | no fix yet |
| High | CVE-2026-106583openssh: openssh: Command injection via unvalidated command-line username | openssh-clientinstalled 1:10.0p1-7+deb13u4 | no fix yet |
| High | CVE-2026-12064curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP | curl, libcurl3t64-gnutls, libcurl4t64installed 8.14.1-2+deb13u7 | no fix yet |
| High | CVE-2026-15308python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations | libpython3.13-minimal, libpython3.13-stdlib, python3.13, python3.13-minimalinstalled 3.13.5-2+deb13u5 | no fix yet |
| High | CVE-2026-16742systemd: systemd-homed: Local privilege escalation via missing home-record signature verification | libsystemd0, libudev1installed 257.13-1~deb13u1 | no fix yet |
| High | CVE-2026-19445python: Use-after-free of a server-side SSLContext when sni_callback switches contexts | libpython3.13-minimal, libpython3.13-stdlib, python3.13, python3.13-minimalinstalled 3.13.5-2+deb13u5 | no fix yet |
| High | CVE-2026-19553python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() | libpython3.13-minimal, libpython3.13-stdlib, python3.13, python3.13-minimalinstalled 3.13.5-2+deb13u5 | no fix yet |
| High | CVE-2026-23102kernel: Linux kernel: Denial of Service due to incorrect SVE context restoration | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-23208kernel: ALSA: usb-audio: Prevent excessive number of frames | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-23327kernel: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-24882GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution | dirmngr, gnupg, gnupg-l10n, gpg +3 moreinstalled 2.4.7-21+deb13u1+b5 | no fix yet |
| High | CVE-2026-31493kernel: RDMA/efa: Fix use of completion ctx after free | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-31568kernel: s390/mm: Add missing secure storage access fixups for donated memory | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-43185kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-46130kernel: dm-verity-fec: fix reading parity bytes split across blocks (take 3) | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-46181kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-46279kernel: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization | linux-libc-devinstalled 6.12.113-1 | no fix yet |
| High | CVE-2026-52991kernel: sched/psi: fix race between file release and pressure write | linux-libc-devinstalled 6.12.113-1 | no fix yet |
Showing the 40 most severe of 1,202 distinct vulnerabilities (2058 findings, one per affected package).
Packages
- Debian packages
- 207
- Go modules
- 10
Image configuration
- Base OS
- Debian 13.7 (trixie)
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- —
- Command
- bash
- Exposed ports
- none
- Image created
- 2026-10-28
- amd64 digest
- sha256:5bbe76a31abbe0f1449d7820e550131c020b097c24d3bcfc5ad1231779982c1c
Other Go tags
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:5bbe76a31abb. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.