ruby:4.0-alpine image size, layers and vulnerabilities (2026-11-01)

docker pull ruby:4.0-alpineruby@sha256:f1e530793cc09e1093417a4c9956069407155e1883d02beb30bda35ae54a47a3

Size per platform

Compressed download size on Docker Hub for each architecture.

arm6450 MB
amd6450 MB
riscv6448 MB
ppc64le45 MB
s390x44 MB
arm/v643 MB
i38643 MB
arm/v742 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

/usr/local/lib78 MB
/usr/lib7.0 MB
/usr/local/include1.6 MB
/bin805 kB
/lib670 kB
/etc/ssl204 kB
/usr/local/bin176 kB
/usr/bin137 kB
/sbin115 kB
/usr/lib/engines-3102 kB

Layers

The 4 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

1. Base filesystem (alpine-minirootfs-3.3.9 MB
2. RUN … create directories189 B
3. RUN … apk add46 MB
4. RUN … create directories139 B

Full build steps

3.9 MBADD alpine-minirootfs-3.24.3-x86_64.tar.gz / # buildkit
189 BRUN /bin/sh -c set -eux; mkdir -p /usr/local/etc; echo 'gem: --no-document' >> /usr/local/etc/gemrc # buildkit
46 MBRUN /bin/sh -c set -eux; apk add --no-cache --virtual .ruby-builddeps autoconf bzip2 bzip2-dev ca-certificates coreutils dpkg-dev dpkg g++ gcc gdbm-dev glib-dev gmp-dev libc-dev libffi-dev libxml2-dev libxslt-dev linux-headers make ncurses-dev openssl openssl-dev patch procps yaml-dev zlib-dev ruby tar xz yaml-dev zlib-dev ; rustArch=; apkArch="$(apk --print-arch)"; case "$apkArch" in 'x86_64') rustArch='x86_64-unknown-linux-musl'; rustupUrl='https://static.rust-lang.org/rustup/archive/1.28.2/x86_64-unknown-linux-musl/rustup-in
139 BRUN /bin/sh -c set -eux; mkdir "$GEM_HOME"; chmod 1777 "$GEM_HOME" # buildkit

Known vulnerabilities

1Critical1 with a fix

0High0 with a fix

0Medium0 with a fix

1Low1 with a fix

0Unknown0 with a fix

2 findings across 105 packages; 2 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

Severity	Vulnerability	Affected packages	Fixed in
Critical	CVE-2026-33210ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection	jsoninstalled 2.18.0	~> 2.15.2.1, ~> 2.17.1.2, >= 2.19.2
Low	CVE-2026-54696json: Ruby JSON: Denial of service via heap buffer overflow with oversized streamed objects	jsoninstalled 2.18.0	>= 2.19.9

Packages

Ruby gems: 84
Alpine packages: 21

Image configuration

Base OS: Alpine Linux 3.24.3
Default user: root (no USER set; the entrypoint may still drop privileges)
Entrypoint: —
Command: irb
Exposed ports: none
Image created: 2026-10-23
amd64 digest: sha256:5a78b7bf435783dd06cf017d467c1e09e67ab6f2d87ecafc23ffab7a762ebca4

Other Ruby tags

ruby:4.01,139 MB unpacked · 430 MB downloadC 17H 445M 1481L 1834? 41 ruby:4.0-slim179 MB unpacked · 81 MB downloadC 1H 43M 60L 61? 1

ruby:4.0-slim vs ruby:4.0-alpine

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:5a78b7bf4357. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.