From cc262ca1ed5343ac2014af17fe2d99fd9aa56864 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@weblate.org>
Date: Thu, 15 Oct 2026 13:48:31 +0200
Subject: [PATCH] fix: remove unused Pebble and file utilities

Remove Ubuntu's untracked Pebble binary and state directory, and stop installing file and its libmagic dependencies.

Keep unzip and xz for manual backups and verify their presence alongside the unused-component absence checks.
---
 Dockerfile         | 5 ++++-
 tests/test-content | 9 ++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 672d13b..34bffe6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,9 +40,13 @@ RUN \
   && install -d -o weblate -g weblate -m 755 /app/cache
 
 # Install dependencies
+# Ubuntu ships Pebble outside dpkg; downstream containers use their own entrypoints.
+# Keep archive tools for manual backups: https://github.com/WeblateOrg/docker/issues/1152
 # hadolint ignore=DL3008,DL3013,SC2046,DL3003
 RUN \
   export DEBIAN_FRONTEND=noninteractive \
+  && rm -f /usr/bin/pebble \
+  && rm -rf /var/lib/pebble \
   && apt-get update \
   && apt-get upgrade -y \
   && apt-get install --no-install-recommends -y \
@@ -57,7 +61,6 @@ RUN \
     gettext \
     gnupg \
     subversion \
-    file \
     locales \
     libldap-common \
     unzip \
diff --git a/tests/test-content b/tests/test-content
index 6a7a59d..82af43f 100755
--- a/tests/test-content
+++ b/tests/test-content
@@ -23,13 +23,20 @@ echo "Listing container content..."
 docker export "$CONTAINER" | tar t > "$STORAGE"
 echo "Checking expected content..."
 
-for ENTRY in app/ app/cache/ app/data/; do
+for ENTRY in app/ app/cache/ app/data/ usr/bin/unzip usr/bin/xz; do
     if ! grep -Fqx "$ENTRY" "$STORAGE"; then
         echo "/$ENTRY is missing!"
         exit 1
     fi
 done
 
+echo "Checking unused components are absent..."
+
+if grep -E '^(usr/bin/(pebble|file)|var/lib/pebble)(/|$)' "$STORAGE"; then
+    echo "Unused components are present!"
+    exit 1
+fi
+
 echo "Checking empty runtime directories..."
 
 # /app/data is not checked because it contains a stub for customization.