docker pull redis:8redis@sha256:4764ce37931aac77c0d033680b339b19b4a4a81772204d268947cb851212d0acSize per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 7 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 30 MB
# debian.sh --arch 'amd64' out/ 'trixie' '@1793059200' - 1 kB
RUN /bin/sh -c set -eux; groupadd -r -g 999 redis; useradd -r -g redis -u 999 redis # buildkit - 831 B
RUN /bin/sh -c set -eux; apt-get update; apt-get install -y --no-install-recommends tzdata ; rm -rf /var/lib/apt/lists/* # buildkit - 26 MB
RUN |2 REDIS_DOWNLOAD_URL=https://github.com/redis/redis/releases/download/8.10.3/redis-full.tar.gz REDIS_DOWNLOAD_SHA=5e0c00ed77f789fb1a4a30f1fbb58a793cc88c41c0f11f0e38e1b4f192991188 /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends ca-certificates wget dpkg-dev gcc g++ libc6-dev libssl-dev libsystemd-dev libzstd-dev pkg-config make; arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; case "$arch" in 'amd64' | 'arm64') BUILD_WITH_MODULES=yes ;; *) echo >&2 "Modules are NOT supporte - 96 B
RUN |2 REDIS_DOWNLOAD_URL=https://github.com/redis/redis/releases/download/8.10.3/redis-full.tar.gz REDIS_DOWNLOAD_SHA=5e0c00ed77f789fb1a4a30f1fbb58a793cc88c41c0f11f0e38e1b4f192991188 /bin/sh -c mkdir /data && chown redis:redis /data # buildkit - 32 B
WORKDIR /data - 2 kB
COPY docker-entrypoint.sh /usr/local/bin/ # buildkit
Known vulnerabilities
0Critical0 with a fix
43High0 with a fix
60Medium0 with a fix
60Low0 with a fix
1Unknown0 with a fix
164 findings across 78 packages; 0 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| High | CVE-2025-69720ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. | libtinfo6, ncurses-base, ncurses-bininstalled 6.5+20250216-2 | no fix yet |
| High | CVE-2026-16742systemd: systemd-homed: Local privilege escalation via missing home-record signature verification | libsystemd0, libudev1installed 257.13-1~deb13u1 | no fix yet |
| High | CVE-2026-54369acl: Symlink traversal privilege escalation via libacl functions | libacl1installed 2.3.2-2+b1 | no fix yet |
| High | CVE-2026-76642util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-78408util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-78409util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-78410util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-9538perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size | perl-baseinstalled 5.40.1-6+deb13u1 | no fix yet |
| Medium | CVE-2026-102010gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if | gcc-14-base, libgcc-s1, libstdc++6installed 14.2.0-19 | no fix yet |
| Medium | CVE-2026-15059systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API | libsystemd0, libudev1installed 257.13-1~deb13u1 | no fix yet |
| Medium | CVE-2026-15534perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine. | perl-baseinstalled 5.40.1-6+deb13u1 | no fix yet |
| Medium | CVE-2026-18374glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-18477tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape | tarinstalled 1.35+dfsg-3.1 | no fix yet |
| Medium | CVE-2026-18508tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite | tarinstalled 1.35+dfsg-3.1 | no fix yet |
| Medium | CVE-2026-19499glibc: Buffer Overflow in strfmon right-justification padding | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-19542glibc: Fix out-of-bounds array write in tdelete | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-27171zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions | zlib1ginstalled 1:1.3.dfsg+really1.3.1-1+b1 | no fix yet |
| Medium | CVE-2026-3184util-linux: util-linux: Access control bypass due to improper hostname canonicalization | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| Medium | CVE-2026-42250bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted file | libbz2-1.0installed 1.0.8-6 | no fix yet |
| Medium | CVE-2026-50812sqlite: SQLite: Denial of Service via malformed changeset in Session Extension | libsqlite3-0installed 3.46.1-7+deb13u2 | no fix yet |
| Medium | CVE-2026-50813sqlite: SQLite: Information disclosure via Session Extension changeset merge path | libsqlite3-0installed 3.46.1-7+deb13u2 | no fix yet |
| Medium | CVE-2026-5435glibc: glibc: Out-of-bounds write via TSIG record processing | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-54370acl: TOCTOU Symlink Traversal via getfacl/setfacl | libacl1installed 2.3.2-2+b1 | no fix yet |
| Medium | CVE-2026-54371attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr | libattr1installed 1:2.5.2-3 | no fix yet |
| Medium | CVE-2026-54411linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module | libpam-modules, libpam-modules-bin, libpam-runtime, libpam0ginstalled 1.7.0-5 | no fix yet |
| Medium | CVE-2026-5704tar: tar: Hidden file injection via crafted archives | tarinstalled 1.35+dfsg-3.1 | no fix yet |
| Medium | CVE-2026-6238glibc: glibc: Application crash or uninitialized memory read via crafted DNS response | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-6368glibc: glibc: Process abort due to invalid memory in wordexp | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-6791glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-77117glibc: Non-progress DoS in SHIFT_JISX0213 -> | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-80489glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-84243glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-85091zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ... | zlib1ginstalled 1:1.3.dfsg+really1.3.1-1+b1 | no fix yet |
| Medium | CVE-2026-8674glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-86805glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-89092glibc: nscd stack overflow leads to degraded DNS resolution | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-95619gcc: libstdc++ integer overflow in `new` operator | gcc-14-base, libgcc-s1, libstdc++6installed 14.2.0-19 | no fix yet |
| Medium | CVE-2026-95818glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Low | CVE-2005-2541tar: does not properly warn the user when extracting setuid or setgid files | tarinstalled 1.35+dfsg-3.1 | no fix yet |
| Low | CVE-2007-5686initscripts in rPath Linux 1 sets insecure permissions for the /var/lo ... | login.defs, passwdinstalled 1:4.17.4-2 | no fix yet |
Showing the 40 most severe of 72 distinct vulnerabilities (164 findings, one per affected package).
Packages
- Debian packages
- 78
Image configuration
- Base OS
- Debian 13.7 (trixie)
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- docker-entrypoint.sh
- Command
- redis-server
- Exposed ports
- 6379/tcp
- Image created
- 2026-10-28
- amd64 digest
- sha256:10b9c2c0711fdeb667f4bcbf5b1175d9dc926674479c9c9f83d7675e98cd89cb
Other Redis tags
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:10b9c2c0711f. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.