[xuwei-fit2cloud]

Summary

• Pin the PostgreSQL 17 Bookworm pgvector image by digest and apply Debian updates in the shared base. Keep the PostgreSQL 17 data directory unchanged. Backport the HarfBuzz fix and remove the unused system TIFF loader while preserving Pillow TIFF support.
• Build and tag the runtime and compiler bases together. Prebuild FreeTDS and install the native toolchain in the compiler base so application builds can reuse them. Keep the Oracle client and license validator in the runtime base.
• Omit the unused ONNX export of the default Chinese embedding model. Keep the PyTorch weights and tokenizer for offline inference. Exclude the PyTorch wheel’s test executables from the runtime image and retain Python’s precompiled bytecode.
• Update the installer's online Compose fallback to v5.7.0. Offline Docker Engine and Compose packages are unchanged.

Validation

• The AMD64 application image went from 1.82 GB to 1.44 GB of compressed image content, a reduction of 377 MB (21%). Excluding the PyTorch test executables saved another 40 MB, bringing the compressed image to 1.40 GB. The optimized manifest is sha256:b7c960e222f4b97b40b35fd6e1a2b6108b32cd09b6ad9dce6621459a4a20477f. Five embedding vectors produced without network access matched byte for byte before and after the change.
• Reopened an isolated volume created on PostgreSQL 17.6, verified existing vector data and its HNSW index, and tested the pgvector extension upgrade. SQLBot returned HTTP 200, both PostgreSQL drivers queried pgvector, MCP listed seven tools and served a 1280 × 960 chart PNG, and Pillow read and wrote TIFF.
• The optimized image retained the package and native library inventory checked against the remediation checklist. The 70 checked Debian entries met their fixed versions; the HarfBuzz backport and system TIFF removal were verified. PyTorch RPC and GLib findings remain open for review.
• Checked the AMD64/ARM64 Bake configuration and the ARM64 PostgreSQL build definition. Runtime validation was on AMD64.

Publish both base images with matching tags before building the application. For a versioned build, pass the matching images through runtimeBaseImage and builderBaseImage.