docker pull postgres:18-alpinepostgres@sha256:10a5c69a83035ab5239f5620d708520e8b28f5aa1f2b20143e6024532edadfb5Size per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 9 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 3.9 MB
ADD alpine-minirootfs-3.24.3-x86_64.tar.gz / # buildkit - 969 B
RUN /bin/sh -c set -eux; addgroup -g 70 -S postgres; adduser -u 70 -S -D -G postgres -H -h /var/lib/postgresql -s /bin/sh postgres; install --verbose --directory --owner postgres --group postgres --mode 1777 /var/lib/postgresql # buildkit - 900 kB
RUN /bin/sh -c set -eux; apk add --no-cache --virtual .gosu-deps ca-certificates dpkg gnupg ; dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; export GNUPGHOME="$(mktemp -d)"; gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/g - 116 B
RUN /bin/sh -c mkdir /docker-entrypoint-initdb.d # buildkit - 115 MB
RUN /bin/sh -c set -eux; wget -O postgresql.tar.bz2 "https://ftp.postgresql.org/pub/source/v$PG_VERSION/postgresql-$PG_VERSION.tar.bz2"; echo "$PG_SHA256 *postgresql.tar.bz2" | sha256sum -c -; mkdir -p /usr/src/postgresql; tar --extract --file postgresql.tar.bz2 --directory /usr/src/postgresql --strip-components 1 ; rm postgresql.tar.bz2; apk add --no-cache --virtual .build-deps $DOCKER_PG_LLVM_DEPS bison coreutils dpkg-dev dpkg flex g++ gcc krb5-dev libc-dev libedit-dev libxml2-dev libxslt-dev linux-headers make openldap-dev openssl-dev perl- - 19 kB
RUN /bin/sh -c set -eux; cp -v /usr/local/share/postgresql/postgresql.conf.sample /usr/local/share/postgresql/postgresql.conf.sample.orig; sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" /usr/local/share/postgresql/postgresql.conf.sample; grep -F "listen_addresses = '*'" /usr/local/share/postgresql/postgresql.conf.sample # buildkit - 129 B
RUN /bin/sh -c install --verbose --directory --owner postgres --group postgres --mode 3777 /var/run/postgresql # buildkit - 6 kB
COPY docker-entrypoint.sh docker-ensure-initdb.sh /usr/local/bin/ # buildkit - 184 B
RUN /bin/sh -c ln -sT docker-ensure-initdb.sh /usr/local/bin/docker-enforce-initdb.sh # buildkit
Known vulnerabilities
2Critical2 with a fix
26High26 with a fix
32Medium32 with a fix
25Low25 with a fix
1Unknown1 with a fix
86 findings across 57 packages; 86 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| Critical | CVE-2025-68121crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption | stdlibinstalled v1.24.6 | 1.24.13, 1.25.7, 1.26.0-rc.3 |
| Critical | CVE-2026-111497brotli: Out-of-Bounds Write in Google Brotli Decoder | brotli-libsinstalled 1.2.0-r1 | 1.2.1-r0 |
| High | CVE-2025-61726golang: net/url: Memory exhaustion in query parameter parsing in net/url | stdlibinstalled v1.24.6 | 1.24.12, 1.25.6 |
| High | CVE-2025-61729crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | stdlibinstalled v1.24.6 | 1.24.11, 1.25.5 |
| High | CVE-2026-111943crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates | stdlibinstalled v1.24.6 | 1.26.10, 1.27.3 |
| High | CVE-2026-25679net/url: Incorrect parsing of IPv6 host literals in net/url | stdlibinstalled v1.24.6 | 1.25.8, 1.26.1 |
| High | CVE-2026-27145crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries | stdlibinstalled v1.24.6 | 1.25.11, 1.26.4 |
| High | CVE-2026-32280crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-32281crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-32283crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-33811net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-33814net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-33818encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-39820net/mail: golang: Go net/mail: Denial of Service via crafted email inputs | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-39821golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-39822golang: Go os.Root: Symlink following vulnerability allows directory traversal | stdlibinstalled v1.24.6 | 1.25.12, 1.26.5, 1.27.0-rc.2 |
| High | CVE-2026-39836net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-42499net/mail: golang: net/mail: Denial of Service via pathological email address parsing | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-42504mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header | stdlibinstalled v1.24.6 | 1.25.11, 1.26.4 |
| High | CVE-2026-56853net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56858html/template: golang: Go html/template: Cross-Site Scripting via pathological input | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56859encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56860net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56862crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-78667net/http: golang: golang: Denial of Service via crafted HTTP Range headers | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| High | CVE-2026-78669net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| High | CVE-2026-92392curl: curl: HTTP/2 upload Use-After-Free | libcurlinstalled 8.22.0-r0 | 8.23.0-r0 |
| High | CVE-2026-97031crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| Medium | CVE-2025-47912net/url: Insufficient validation of bracketed IPv6 hostnames in net/url | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-58183golang: archive/tar: Unbounded allocation when parsing GNU sparse map | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-58185encoding/asn1: Parsing DER payload can cause memory exhaustion in encoding/asn1 | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-58187crypto/x509: Quadratic complexity when checking name constraints in crypto/x509 | stdlibinstalled v1.24.6 | 1.24.9, 1.25.3 |
| Medium | CVE-2025-58188crypto/x509: golang: Panic when validating certificates with DSA public keys in crypto/x509 | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-58189crypto/tls: go crypto/tls ALPN negotiation error contains attacker controlled information | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-61723encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-61724net/textproto: Excessive CPU consumption in Reader.ReadResponse in net/textproto | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-61725net/mail: Excessive CPU consumption in ParseAddress in net/mail | stdlibinstalled v1.24.6 | 1.24.8, 1.25.2 |
| Medium | CVE-2025-61727golang: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs | stdlibinstalled v1.24.6 | 1.24.11, 1.25.5 |
| Medium | CVE-2025-61728golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip | stdlibinstalled v1.24.6 | 1.24.12, 1.25.6 |
| Medium | CVE-2025-61730crypto/tls: Handshake messages may be processed at the incorrect encryption level in crypto/tls | stdlibinstalled v1.24.6 | 1.24.12, 1.25.6 |
Showing the 40 most severe of 86 distinct vulnerabilities (86 findings, one per affected package).
Packages
- Alpine packages
- 53
- Go modules
- 4
Image configuration
- Base OS
- Alpine Linux 3.24.3
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- docker-entrypoint.sh
- Command
- postgres
- Exposed ports
- 5432/tcp
- Image created
- 2026-10-21
- amd64 digest
- sha256:3b0ef735388b2cb097fc29b8bb421d86d57d0ddbe7aa1fbd6493e06d65028503
Other PostgreSQL tags
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:3b0ef735388b. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.