docker: Install missing lowdown and libsodium dependencies
What the developer wrote
Authored by ShahanaFarooqui
docker: Install missing lowdown and libsodium dependencies
What changed, and why it matters
This commit updates the project's Docker build file to install two missing software libraries (lowdown and libsodium) and set related environment variables so the container can compile and run correctly. It is a build-fix change, not a patch for an active security vulnerability. There is no evidence in the commit or supplied references that this fixes a known exploit or was disclosed as a security issue.
No immediate security action required. Review whether the dependency additions are intentional and whether libsodium is used for cryptographic operations; if so, ensure the installed version is kept up to date. Treat as a routine build maintenance commit.
Security signals we found
No security-relevant keywords in commit title or message
No CVE, advisory, or exploit references in commit or supplied materials
Change is limited to Dockerfile dependency installation and environment variables
No code logic changes affecting cryptography, networking, or authorization
Evidence from the diff
The Dockerfile change adds lowdown (architecture-independent) and libsodium-dev plus libsodium23 (target-arch and runtime) to the Docker image, and sets PKG_CONFIG_PATH/PKG_CONFIG_LIBDIR to the target architecture pkgconfig directory. These are dependency additions required for the build/runtime environment. The commit title and message describe it as installing missing dependencies; no CVE, security advisory, or vulnerability description is present in the commit or provided references.
Changed components
Dockerfile build environmentlowdown package installationlibsodium-dev and libsodium23 package installationPKG_CONFIG_PATH and PKG_CONFIG_LIBDIR environment variablesInspect captured patch +7 / −2
diff --git a/Dockerfile b/Dockerfile
index 7764478f..63a923ed 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -103,7 +103,8 @@ RUN dpkg --add-architecture ${target_arch_dpkg}
# Install architecture-independent libraries
RUN apt-get update && \
apt-get install -qq -y --no-install-recommends \
- python3-dev
+ python3-dev \
+ lowdown
# Install target-arch libraries
RUN apt-get install -qq -y --no-install-recommends \
@@ -113,6 +114,7 @@ RUN apt-get install -qq -y --no-install-recommends \
zlib1g-dev:${target_arch_dpkg} \
libsqlite3-dev:${target_arch_dpkg} \
libpq-dev:${target_arch_dpkg} \
+ libsodium-dev:${target_arch_dpkg} \
crossbuild-essential-${target_arch_dpkg}
ARG AR=${target_arch}-ar
@@ -142,6 +144,8 @@ RUN ./install-uv.sh -q
RUN ./install-rust.sh -y -q --profile minimal --component rustfmt --target ${target_arch_rust}
ENV PATH="/root/.cargo/bin:/root/.local/bin:${PATH}"
+ENV PKG_CONFIG_PATH=/usr/lib/${target_arch}/pkgconfig
+ENV PKG_CONFIG_LIBDIR=/usr/lib/${target_arch}/pkgconfig
WORKDIR /opt/lightningd
@@ -165,7 +169,8 @@ RUN apt-get update && \
socat \
jq \
libpq5 \
- libsqlite3-0 && \
+ libsqlite3-0 \
+ libsodium23 && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.