docker pull postgres:18postgres@sha256:3a4264520e121176619f54ff867d12774bc81e95e7b84db58d63bccdb6144b81Size per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 13 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 30 MB
# debian.sh --arch 'amd64' out/ 'trixie' '@1793059200' - 1 kB
RUN /bin/sh -c set -eux; groupadd -r postgres --gid=999; useradd -r -g postgres --uid=999 --home-dir=/var/lib/postgresql --shell=/bin/bash postgres; install --verbose --directory --owner postgres --group postgres --mode 1777 /var/lib/postgresql # buildkit - 6.4 MB
RUN /bin/sh -c set -ex; apt-get update; apt-get install -y --no-install-recommends gnupg less ; rm -rf /var/lib/apt/lists/* # buildkit - 1.3 MB
RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends ca-certificates wget; rm -rf /var/lib/apt/lists/*; dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; export GNUPGHOME="$(mktemp -d)"; gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C2 - 8.2 MB
RUN /bin/sh -c set -eux; if [ -f /etc/dpkg/dpkg.cfg.d/docker ]; then grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; sed -ri '/\/usr\/share\/locale/d' /etc/dpkg/dpkg.cfg.d/docker; ! grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; fi; apt-get update; apt-get install -y --no-install-recommends locales; rm -rf /var/lib/apt/lists/*; echo 'en_US.UTF-8 UTF-8' >> /etc/locale.gen; locale-gen; locale -a | grep 'en_US.utf8' # buildkit - 1.3 MB
RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends libnss-wrapper xz-utils zstd ; rm -rf /var/lib/apt/lists/* # buildkit - 116 B
RUN /bin/sh -c mkdir /docker-entrypoint-initdb.d # buildkit - 3 kB
RUN /bin/sh -c set -ex; key='B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8'; export GNUPGHOME="$(mktemp -d)"; mkdir -p /usr/local/share/keyrings/; gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; gpg --batch --export --armor "$key" > /usr/local/share/keyrings/postgres.gpg.asc; gpgconf --kill all; rm -rf "$GNUPGHOME" # buildkit - 115 MB
RUN /bin/sh -c set -ex; export PYTHONDONTWRITEBYTECODE=1; dpkgArch="$(dpkg --print-architecture)"; aptRepo="[ signed-by=/usr/local/share/keyrings/postgres.gpg.asc ] http://apt.postgresql.org/pub/repos/apt trixie-pgdg main $PG_MAJOR"; case "$dpkgArch" in amd64 | arm64 | loong64 | ppc64el) echo "deb $aptRepo" > /etc/apt/sources.list.d/pgdg.list; apt-get update; ;; *) echo "deb-src $aptRepo" > /etc/apt/sources.list.d/pgdg.list; savedAptMark="$(apt-mark showmanual)"; tempDir="$(mktemp -d)"; cd "$tempDir"; apt-get update; apt-get install -y --no-install - 19 kB
RUN /bin/sh -c set -eux; dpkg-divert --add --rename --divert "/usr/share/postgresql/postgresql.conf.sample.dpkg" "/usr/share/postgresql/$PG_MAJOR/postgresql.conf.sample"; cp -v /usr/share/postgresql/postgresql.conf.sample.dpkg /usr/share/postgresql/postgresql.conf.sample; ln -sv ../postgresql.conf.sample "/usr/share/postgresql/$PG_MAJOR/"; sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" /usr/share/postgresql/postgresql.conf.sample; grep -F "listen_addresses = '*'" /usr/share/postgresql/postgresql.conf.sample # buildkit - 127 B
RUN /bin/sh -c install --verbose --directory --owner postgres --group postgres --mode 3777 /var/run/postgresql # buildkit - 6 kB
COPY docker-entrypoint.sh docker-ensure-initdb.sh /usr/local/bin/ # buildkit - 185 B
RUN /bin/sh -c ln -sT docker-ensure-initdb.sh /usr/local/bin/docker-enforce-initdb.sh # buildkit
Known vulnerabilities
2Critical1 with a fix
86High25 with a fix
144Medium31 with a fix
141Low3 with a fix
5Unknown1 with a fix
378 findings across 149 packages; 61 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| Critical | CVE-2025-68121crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption | stdlibinstalled v1.24.6 | 1.24.13, 1.25.7, 1.26.0-rc.3 |
| Critical | CVE-2026-6653libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2025-61726golang: net/url: Memory exhaustion in query parameter parsing in net/url | stdlibinstalled v1.24.6 | 1.24.12, 1.25.6 |
| High | CVE-2025-61729crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate | stdlibinstalled v1.24.6 | 1.24.11, 1.25.5 |
| High | CVE-2026-111943crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates | stdlibinstalled v1.24.6 | 1.26.10, 1.27.3 |
| High | CVE-2026-25679net/url: Incorrect parsing of IPv6 host literals in net/url | stdlibinstalled v1.24.6 | 1.25.8, 1.26.1 |
| High | CVE-2026-27145crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries | stdlibinstalled v1.24.6 | 1.25.11, 1.26.4 |
| High | CVE-2026-32280crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-32281crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-32283crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages | stdlibinstalled v1.24.6 | 1.25.9, 1.26.2 |
| High | CVE-2026-33811net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-33814net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-33818encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-39820net/mail: golang: Go net/mail: Denial of Service via crafted email inputs | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-39821golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-39822golang: Go os.Root: Symlink following vulnerability allows directory traversal | stdlibinstalled v1.24.6 | 1.25.12, 1.26.5, 1.27.0-rc.2 |
| High | CVE-2026-39836net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-42499net/mail: golang: net/mail: Denial of Service via pathological email address parsing | stdlibinstalled v1.24.6 | 1.25.10, 1.26.3 |
| High | CVE-2026-42504mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header | stdlibinstalled v1.24.6 | 1.25.11, 1.26.4 |
| High | CVE-2026-56853net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56858html/template: golang: Go html/template: Cross-Site Scripting via pathological input | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56859encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56860net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-56862crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages | stdlibinstalled v1.24.6 | 1.25.13, 1.26.6, 1.27.0-rc.3 |
| High | CVE-2026-78667net/http: golang: golang: Denial of Service via crafted HTTP Range headers | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| High | CVE-2026-78669net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| High | CVE-2026-97031crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references | stdlibinstalled v1.24.6 | 1.26.9, 1.27.2 |
| High | CVE-2025-69720ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. | libncursesw6, libtinfo6, ncurses-base, ncurses-bininstalled 6.5+20250216-2 | no fix yet |
| High | CVE-2026-16742systemd: systemd-homed: Local privilege escalation via missing home-record signature verification | libsystemd0, libudev1installed 257.13-1~deb13u1 | no fix yet |
| High | CVE-2026-24882GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution | dirmngr, gnupg, gnupg-l10n, gpg +3 moreinstalled 2.4.7-21+deb13u1+b5 | no fix yet |
| High | CVE-2026-54369acl: Symlink traversal privilege escalation via libacl functions | libacl1installed 2.3.2-2+b1 | no fix yet |
| High | CVE-2026-74860libxml2: double-free/UAF in libxml2 Python bindings | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2026-76642util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-78408util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-78409util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-78410util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-86138libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2026-86139libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2026-86140libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2026-86142libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
Showing the 40 most severe of 179 distinct vulnerabilities (378 findings, one per affected package).
Packages
- Debian packages
- 145
- Go modules
- 4
Image configuration
- Base OS
- Debian 13.7 (trixie)
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- docker-entrypoint.sh
- Command
- postgres
- Exposed ports
- 5432/tcp
- Image created
- 2026-10-28
- amd64 digest
- sha256:f4b419e350fd98d4a8429603295208976dea4c8fb8326d818d346d3e29f1db6f
Other PostgreSQL tags
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:f4b419e350fd. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.