On this page
ADR-0020: BusyBox is rebuilt with network applets compiled out
Status: Accepted (WP-20, recorded in docs/status/WP-20.md). Implemented in projects/base/image/busybox/.
Context
The base image needs a POSIX shell and a few core utilities for entrypoints. Alpine's
BusyBox also contains wget, nc, nslookup, sendmail, ping and administration
applets. Removing only the symlinks would leave them reachable as busybox wget.
Decision
- Rebuild Alpine's own BusyBox package from Alpine's source: the
APKBUILDofmain/busyboxat a pinned aports commit (checked against a pinned SHA-256), the upstream tarball and every Alpine patch (checked against the APKBUILD's SHA-512 list), Alpine's configuration, then switch off the applets listed inprojects/base/image/busybox/config-deny.txt. - The build fails if any forbidden applet exists; the image tests check it again.
- The build also stops when Alpine ships a newer BusyBox revision than the pinned one, so the rebuild cannot silently fall behind security fixes.
Consequences
- The apk database keeps Alpine's BusyBox entry (same version and patches), so scanners match BusyBox vulnerabilities correctly. The file checksums in the database differ from the rebuilt binary.
- CVE-2025-60876 (BusyBox
wget, medium, no upstream fix at the time of writing) is reported by Grype against every image. The base image ships an OpenVEX statementnot_affected/vulnerable_code_not_presentfor it (ADR-0034), which is true because the applet does not exist in the binary. - Keeping the rebuild current is a recurring maintenance task of the base image.