iamgp · Jul 27, 2026 · Jul 22, 2026 · Jul 22, 2026 · Jul 22, 2026 · Jul 22, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -295,6 +295,72 @@ jobs:
             exit 1
           fi
 
+  generated-container-checks:
+    name: containers / generated service files
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
+        with:
+          version: "0.10.10"
+
+      - name: Set up Python
+        run: uv python install 3.11
+
+      - name: Build Phlo and service wheels
+        run: uv build --all-packages --wheel --out-dir "$RUNNER_TEMP/phlo-container-wheelhouse"
+
+      - name: Cache Trivy vulnerability and scan data
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ${{ runner.temp }}/phlo-trivy-cache
+          key: trivy-${{ runner.os }}-v2-${{ github.run_number }}
+          restore-keys: |
+            trivy-${{ runner.os }}-v2-
+
+      - name: Install wheels into a clean environment
+        shell: bash
+        run: |
+          set -euo pipefail
+          env_dir="$RUNNER_TEMP/phlo-container-env"
+          uv venv "$env_dir" --python 3.11
+          uv pip install \
+            --python "$env_dir/bin/python" \
+            --find-links "$RUNNER_TEMP/phlo-container-wheelhouse" \
+            phlo \
+            phlo-alloy \
+            phlo-api \
+            phlo-clickhouse \
+            phlo-clickstack \
+            phlo-dagster \
+            phlo-grafana \
+            phlo-hasura \
+            phlo-loki \
+            phlo-minio \
+            phlo-nessie \
+            phlo-oauth2-proxy \
+            phlo-openmetadata \
+            phlo-observatory \
+            phlo-pgweb \
+            phlo-postgres \
+            phlo-postgrest \
+            phlo-prometheus \
+            phlo-rustfs \
+            phlo-superset \
+            phlo-traefik \
+            phlo-trino
+          echo "$env_dir/bin" >> "$GITHUB_PATH"
+
+      - name: Check generated service containers
+        env:
+          PHLO_TRIVY_CACHE_DIR: ${{ runner.temp }}/phlo-trivy-cache
+        run: phlo --no-color plugin check --containers
+
   release-golden-path:
     name: python / release golden path
     runs-on: ubuntu-latest
@@ -496,6 +562,7 @@ jobs:
       - python-quality
       - python-core-tests
       - quickstart-smoke
+      - generated-container-checks
       - release-golden-path
       - recovery-continuity-drill
       - windows-release-contract
@@ -509,6 +576,7 @@ jobs:
           PYTHON_QUALITY: ${{ needs.python-quality.result }}
           PYTHON_CORE_TESTS: ${{ needs.python-core-tests.result }}
           QUICKSTART_SMOKE: ${{ needs.quickstart-smoke.result }}
+          GENERATED_CONTAINER_CHECKS: ${{ needs.generated-container-checks.result }}
           RELEASE_GOLDEN_PATH: ${{ needs.release-golden-path.result }}
           RECOVERY_CONTINUITY_DRILL: ${{ needs.recovery-continuity-drill.result }}
           WINDOWS_RELEASE_CONTRACT: ${{ needs.windows-release-contract.result }}
@@ -526,6 +594,7 @@ jobs:
             echo "| python / quality | ${PYTHON_QUALITY} |"
             echo "| python / core tests | ${PYTHON_CORE_TESTS} |"
             echo "| python / quickstart smoke | ${QUICKSTART_SMOKE} |"
+            echo "| containers / generated service files | ${GENERATED_CONTAINER_CHECKS} |"
             echo "| python / release golden path | ${RELEASE_GOLDEN_PATH} |"
             echo "| python / recovery continuity drill | ${RECOVERY_CONTINUITY_DRILL} |"
             echo "| windows / release golden path contract | ${WINDOWS_RELEASE_CONTRACT} |"
@@ -538,6 +607,7 @@ jobs:
             "${PYTHON_QUALITY}" \
             "${PYTHON_CORE_TESTS}" \
             "${QUICKSTART_SMOKE}" \
+            "${GENERATED_CONTAINER_CHECKS}" \
             "${RELEASE_GOLDEN_PATH}" \
             "${RECOVERY_CONTINUITY_DRILL}" \
             "${WINDOWS_RELEASE_CONTRACT}" \

diff --git a/packages/phlo-alloy/src/phlo_alloy/service.yaml b/packages/phlo-alloy/src/phlo_alloy/service.yaml
@@ -4,7 +4,7 @@ category: observability
 default: false
 profile: observability
 
-image: grafana/alloy:v1.4.2
+image: grafana/alloy:v1.18.0
 
 compose:
   restart: unless-stopped

diff --git a/packages/phlo-api/src/phlo_api/Dockerfile b/packages/phlo-api/src/phlo_api/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11-slim AS phlo-build-context
+FROM python:3.11-alpine AS phlo-build-context
 
 WORKDIR /opt/phlo-build-context
 
@@ -8,15 +8,21 @@ RUN set -eux; \
     install -m 0755 "$entrypoint" /opt/phlo-build-context/phlo-api-entrypoint.sh; \
     mkdir -p /opt/phlo-build-context/wheelhouse
 
-FROM python:3.11-slim
+FROM python:3.11-alpine
 
 WORKDIR /app
 
 ARG PHLO_VERSION=
 ARG PHLO_API_VERSION=
 ARG PHLO_WHEELHOUSE=
 
-RUN pip install --no-cache-dir uv
+RUN apk upgrade --no-cache \
+    && apk add --no-cache ca-certificates \
+    && apk add --no-cache --virtual .build-deps gcc musl-dev \
+    && pip install --no-cache-dir \
+        "setuptools==83.0.0" \
+        "wheel==0.47.0" \
+        "uv==0.8.13"
 
 COPY --from=phlo-build-context /opt/phlo-build-context/wheelhouse /opt/phlo-wheelhouse
 
@@ -34,10 +40,19 @@ RUN set -eux; \
         uv pip install --system --prerelease explicit "$PHLO_REQUIREMENT" "$PHLO_API_REQUIREMENT"; \
     else \
         uv pip install --system phlo "$PHLO_API_REQUIREMENT"; \
-    fi
+    fi && apk del .build-deps
+
+# Do not retain uv's downloaded archives in the runtime image; they are not needed to run Phlo.
+RUN rm -rf /root/.cache/uv
 
 COPY --from=phlo-build-context /opt/phlo-build-context/phlo-api-entrypoint.sh /usr/local/bin/phlo-api-entrypoint.sh
 
+RUN addgroup -S phlo \
+    && adduser -S -G phlo -h /app -H phlo \
+    && chown -R phlo:phlo /app
+
+USER phlo
+
 EXPOSE 4000
 
 ENTRYPOINT ["/usr/local/bin/phlo-api-entrypoint.sh"]

diff --git a/packages/phlo-dagster/src/phlo_dagster/Dockerfile b/packages/phlo-dagster/src/phlo_dagster/Dockerfile
@@ -1,11 +1,11 @@
-FROM python:3.12-slim AS phlo-build-context
+FROM python:3.12-alpine AS phlo-build-context
 
 WORKDIR /opt/phlo-build-context
 
 COPY . .
 RUN mkdir -p /opt/phlo-build-context/wheelhouse
 
-FROM python:3.12-slim
+FROM python:3.12-alpine
 
 WORKDIR /opt/dagster
 
@@ -14,11 +14,12 @@ ARG PHLO_DBT_VERSION=""
 ARG PHLO_WHEELHOUSE=""
 
 # Install system dependencies and uv
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl \
-    git \
-    && rm -rf /var/lib/apt/lists/* \
-    && pip install uv
+RUN apk upgrade --no-cache \
+    && apk add --no-cache bash ca-certificates curl git \
+    && apk add --no-cache --virtual .build-deps gcc musl-dev \
+    && pip install --no-cache-dir "uv==0.8.13"
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 # Copy only the artifact directory from the context stage; normal generated builds receive an
 # empty directory and retain the existing PyPI installation path.
@@ -38,15 +39,25 @@ RUN \
     else \
         uv pip install --system --no-deps --prerelease explicit "phlo==$PHLO_VERSION"; \
         PHLO_PRERELEASE_REQUIREMENTS="$(python -c 'import importlib.metadata as md, re; print(" ".join(req.split(";")[0].strip() for req in (md.metadata("phlo").get_all("Requires-Dist") or []) if "extra == '\''defaults'\''" in req and re.search(r"(a|b|rc|dev)[0-9]+", req)))')"; \
-        uv pip install --system --prerelease explicit "phlo[defaults]==$PHLO_VERSION" "$PHLO_DBT_REQUIREMENT" $PHLO_PRERELEASE_REQUIREMENTS dagster-webserver dagster-postgres "psycopg[binary]"; \
+        base_requirements=("phlo[defaults]==$PHLO_VERSION" "$PHLO_DBT_REQUIREMENT" dagster-webserver dagster-postgres "psycopg[binary]"); \
+        if [ -n "$PHLO_PRERELEASE_REQUIREMENTS" ]; then read -r -a prerelease_requirements <<< "$PHLO_PRERELEASE_REQUIREMENTS"; base_requirements+=("${prerelease_requirements[@]}"); fi; \
+        uv pip install --system --prerelease explicit "${base_requirements[@]}"; \
     fi; \
     else \
         uv pip install --system "phlo[defaults]" "$PHLO_DBT_REQUIREMENT" dagster-webserver dagster-postgres "psycopg[binary]"; \
-    fi
+    fi && apk del .build-deps
+
+# Do not retain uv's downloaded archives in the runtime image; they are not needed to run Phlo.
+RUN rm -rf /root/.cache/uv
 
 # Keep entrypoint outside /opt/dagster so dev volume mounts never hide it.
 COPY dagster/entrypoint.sh /usr/local/bin/phlo-dagster-entrypoint.sh
-RUN chmod +x /usr/local/bin/phlo-dagster-entrypoint.sh
+RUN chmod +x /usr/local/bin/phlo-dagster-entrypoint.sh \
+    && addgroup -S phlo \
+    && adduser -S -G phlo -h /opt/dagster -H phlo \
+    && chown -R phlo:phlo /opt/dagster
+
+USER phlo
 
 # Copy workspace configuration
 COPY dagster/workspace.yaml /opt/dagster/workspace.yaml

diff --git a/packages/phlo-dagster/tests/test_runtime_image_contract.py b/packages/phlo-dagster/tests/test_runtime_image_contract.py
@@ -7,16 +7,16 @@
 def test_dagster_runtime_image_installs_prerelease_phlo_with_postgres_driver() -> None:
     dockerfile = resources.files("phlo_dagster").joinpath("Dockerfile").read_text()
 
-    assert dockerfile.startswith("FROM python:3.12-slim")
+    assert dockerfile.startswith("FROM python:3.12-alpine")
     assert (
         'uv pip install --system --no-deps --prerelease explicit "phlo==$PHLO_VERSION"'
         in dockerfile
     )
     assert "PHLO_PRERELEASE_REQUIREMENTS" in dockerfile
     assert (
-        'uv pip install --system --prerelease explicit "phlo[defaults]==$PHLO_VERSION"'
-        in dockerfile
+        'base_requirements=("phlo[defaults]==$PHLO_VERSION" "$PHLO_DBT_REQUIREMENT"' in dockerfile
     )
+    assert 'uv pip install --system --prerelease explicit "${base_requirements[@]}"' in dockerfile
     assert 'dagster-postgres "psycopg[binary]"' in dockerfile
 
 

diff --git a/packages/phlo-grafana/README.md b/packages/phlo-grafana/README.md
@@ -23,7 +23,7 @@ Part of the `observability` profile.
 | Variable                 | Default  | Description         |
 | ------------------------ | -------- | ------------------- |
 | `GRAFANA_PORT`           | `3003`   | Grafana web UI port |
-| `GRAFANA_VERSION`        | `11.3.1` | Grafana version     |
+| `GRAFANA_VERSION`        | `13.1.1` | Grafana version     |
 | `GRAFANA_ADMIN_USER`     | `admin`  | Admin username      |
 | `GRAFANA_ADMIN_PASSWORD` | `admin`  | Admin password      |
 

diff --git a/packages/phlo-grafana/src/phlo_grafana/dashboards/cascade-overview.json b/packages/phlo-grafana/src/phlo_grafana/dashboards/cascade-overview.json
@@ -67,7 +67,7 @@
         },
         "textMode": "auto"
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {
@@ -127,7 +127,7 @@
         },
         "textMode": "auto"
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {
@@ -187,7 +187,7 @@
         },
         "textMode": "auto"
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {
@@ -247,7 +247,7 @@
         },
         "textMode": "auto"
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {
@@ -369,7 +369,7 @@
           "sort": "none"
         }
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {
@@ -456,7 +456,7 @@
           "sort": "none"
         }
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {

diff --git a/packages/phlo-grafana/src/phlo_grafana/dashboards/infrastructure.json b/packages/phlo-grafana/src/phlo_grafana/dashboards/infrastructure.json
@@ -87,7 +87,7 @@
         "sizing": "auto",
         "valueMode": "color"
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {
@@ -235,7 +235,7 @@
           "sort": "none"
         }
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {
@@ -371,7 +371,7 @@
           "sort": "none"
         }
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {
@@ -467,7 +467,7 @@
           "sort": "none"
         }
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {
@@ -567,7 +567,7 @@
           "sort": "none"
         }
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {
@@ -664,7 +664,7 @@
           "sort": "none"
         }
       },
-      "pluginVersion": "11.3.1",
+      "pluginVersion": "13.1.1",
       "targets": [
         {
           "datasource": {

diff --git a/packages/phlo-grafana/src/phlo_grafana/service.yaml b/packages/phlo-grafana/src/phlo_grafana/service.yaml
@@ -4,7 +4,7 @@ category: observability
 default: false
 profile: observability
 
-image: grafana/grafana:${GRAFANA_VERSION:-11.3.1}
+image: grafana/grafana:${GRAFANA_VERSION:-13.1.1}
 
 depends_on:
   - prometheus
@@ -43,7 +43,7 @@ compose:
 
 env_vars:
   GRAFANA_VERSION:
-    default: "11.3.1"
+    default: "13.1.1"
     description: Grafana version
   GRAFANA_PORT:
     default: 3003

diff --git a/packages/phlo-hasura/README.md b/packages/phlo-hasura/README.md
@@ -23,7 +23,7 @@ Part of the `api` profile.
 | Variable              | Default                    | Description             |
 | --------------------- | -------------------------- | ----------------------- |
 | `HASURA_PORT`         | `8082`                     | Hasura console/API port |
-| `HASURA_VERSION`      | `v2.46.0`                  | Hasura version          |
+| `HASURA_VERSION`      | `v2.49.5`                  | Hasura version          |
 | `HASURA_ADMIN_SECRET` | `phlo-hasura-admin-secret` | Admin secret            |
 
 ## Auto-Configuration