ClickHouse on Docker Hardened Images

Summary

ClickHouse is now available as Docker Hardened Images (DHI), stripped-down builds for the ClickHouse server, ClickHouse Keeper, Kubernetes Operator and Helm chart, and metrics exporter. The standard image’s Ubuntu 22.04 base includes unused packages such as Perl, wget, and apt, whose known CVEs can block enterprise deployments even though ClickHouse does not use them. DHI replaces that base with a minimal image that has no package manager or network tools, runs as non-root, provides SLSA Level 3 provenance, and is maintained for CVE patching; Docker Scout reported 0 medium and 14 low findings for DHI, versus 8 medium and 11 low across 111 packages in the standard image. Migration preserves volumes and configuration, while development tooling remains available through a dev variant or temporary docker debug attachment.

Takeaways

1. 1

   Docker Scout reported 8 medium and 11 low findings across 111 packages for the standard image, compared with 0 medium and 14 low findings for the DHI image.

2. 2

   The hardened ClickHouse server image keeps volumes and configuration compatible, but uses the dhi.io/clickhouse-server:26.2-debian13 image reference and may require CLICKHOUSE_PASSWORD for network access.

3. 3

   DHI images remove common debugging and package-management tools from production images; a dev variant and docker debug provide those tools without rebuilding the hardened image.