Owner decision, 2026-08-27, taken while scoping #144.
The community image is Alpine (musl); the Marketplace image is Chainguard/Wolfi (glibc). That difference has been invisible so far, but it stops a whole class of dependency from ever shipping in the community edition: aiortc — the WebRTC media stack #144 needs — publishes no musllinux wheels for any version, and neither does its hard dependency google-crc32c. Building them from source on Alpine is not a road worth taking.
Three ways out were considered: ship WebRTC nowhere, ship it on the Marketplace image only, or remove the divergence at its root. The owner chose the root fix, so that the two images stay capability-identical and "community edition" continues to mean the same product under a different licence.
Scope:
- Rebase the community
Dockerfile onto a glibc base. Evaluate matching the Marketplace image's Wolfi base, since converging the two is the outcome that removes the most divergence — the standing rule is that two repositories doing the same thing differently costs more than either shortcut saves.
- Keep every property the current image is chosen for: no shell, no package manager, read-only root filesystem, minimal attack surface, and the pruning that keeps it small. Report the size and CVE-surface change honestly rather than assuming a glibc base is equivalent.
- The container test lane must keep passing, including the parts that reconstruct the healthcheck from image history — note that podman builds OCI format, which has no healthcheck field.
- Confirm every currently-pinned dependency still resolves and that nothing depended on musl.
This lands before #144, which cannot start until the base is settled, and it is deliberately its own issue rather than part of #144: it changes a shipped artefact that every community user pulls, and it should be separable in the release notes and bisectable on its own.
Ref: .claude/skills/stdapi-container-image, Dockerfile, stdapi.ai-internal/Dockerfile
Owner decision, 2026-08-27, taken while scoping #144.
The community image is Alpine (musl); the Marketplace image is Chainguard/Wolfi (glibc). That difference has been invisible so far, but it stops a whole class of dependency from ever shipping in the community edition:
aiortc— the WebRTC media stack #144 needs — publishes no musllinux wheels for any version, and neither does its hard dependencygoogle-crc32c. Building them from source on Alpine is not a road worth taking.Three ways out were considered: ship WebRTC nowhere, ship it on the Marketplace image only, or remove the divergence at its root. The owner chose the root fix, so that the two images stay capability-identical and "community edition" continues to mean the same product under a different licence.
Scope:
Dockerfileonto a glibc base. Evaluate matching the Marketplace image's Wolfi base, since converging the two is the outcome that removes the most divergence — the standing rule is that two repositories doing the same thing differently costs more than either shortcut saves.This lands before #144, which cannot start until the base is settled, and it is deliberately its own issue rather than part of #144: it changes a shipped artefact that every community user pulls, and it should be separable in the release notes and bisectable on its own.
Ref:
.claude/skills/stdapi-container-image,Dockerfile,stdapi.ai-internal/Dockerfile