You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
hi Reinaldy!
yesterday i made some progress on distroless Sentry. here are some highlights, maybe it's worth adding to the next self-hosted release notes:
• sentry containers now run directly as sentry user, without root+gosu to sentry (#4535).
• sentry and snuba now have similar approach with healthchecks - via python script (#4539).
• upgraded debian in base image from 12 to 13 (getsentry/sentry#126031).
• started creating -distroless image variant (getsentry/sentry#126030).
• healthchecks work #4539 (comment).
• did a quick run of distroless variant with a throwaway branch, which bypassed some minor bash entrypoint issues that we yet to decide - no issues 🎉 .
If you don't know yet, sentry has a RFC process in which Alex submitted one for distroless: getsentry/rfcs#157
Sidenote: awesome work with the past few releases! The reduction in containers/deployment complexity is a very nice direction, looking forward to distroless containers and S3-less nodestore! 🥳
Reacted by Reinaldy Rafli, Alexander Tarasov, geoffg-sentry, not this jeffrey and michelletran-sentry
This version upgrades Postgres 14 to 18. If you are very concerned about your data, make sure to take a snapshot of your server before upgrading!
Postgres 18 Upgrade
We've finally moved off our very old Postgres 14 and onto Postgres 18. This upgrade includes a breaking change in how Postgres data is stored. See docker-library/postgres#1259 for the details.
If you ever encountered a problem, come to Discord for direct help.
Going Distroless
Distroless images are even more minimal (in terms of image size and included packages) than debian:slim, and in some cases than Alpine. They contain only the application and its runtime dependencies, with no OS shell or package manager. That leaves far less to flag when you scan with Trivy or similar tools. They’re also smaller, which means faster image downloads and less disk space used on your host.
Sentry's RFC process is how this work got started. Alex, our security engineer, submitted an RFC for distroless, and the changes below follow from it:
Sentry runs as the sentry user directly. Containers no longer start as root and drop privileges through gosu. This removes a moving part, and there's no root process to worry about (self-hosted#4535).
Sentry and Snuba share a healthcheck approach. Both now use a Python script for healthchecks (self-hosted#4539). We've confirmed these work on our self-hosted-lol setup, as shown here.
The base image moved from Debian 12 to Debian 13 (sentry#126031). The size and CVE comparison between the two is in the PR comments.
We started building a -distroless image variant (sentry#126030). For a comparison against the standard Debian 13 image, see this comment.
We ran a quick test of the distroless variant from a throwaway branch. That branch sidestepped a few minor bash entrypoint issues we haven’t settled on yet, and the run itself had no problems. The distroless sentry image isn’t the default yet, so you’ll need to opt in via :nightly-distroless to use it.
Here’s where each service stands:
Relay and Symbolicator: distroless since 2025.
Snuba: distroless.
Vroom: distroless starting with the next release, 26.11.0.
Launchpad, Taskbroker, Uptime-checker, and Sentry: in progress.
Experimental Features to Try
organizations:attribute-management enables the Settings > Attributes browser and editor page.
organizations:relay-automatic-json-expansion and organizations:explore-automatic-json-expansion-ui control the expansion config. The flag names don't say much, but they let you expand JSON logs, which is worth a look.
Other Notable Things
The login page has a new design. Enjoy it.
Log search now supports regular expressions. See the changelog entry.
We no longer build the jq image ourselves. We use the official one now (self-hosted#4547).
Breaking change: Vroom's SENTRY_BUCKET_PROFILES has changed. If you use external storage (S3-compatible or GCS), update your configuration before upgrading.
We're always happy to chat about setups, upgrades, or whatever's giving you trouble. Come find us on Discord.
Activity
aldy505 commentedon Oct 4, 2026
Message from @oioki:
hi Reinaldy!
yesterday i made some progress on distroless Sentry. here are some highlights, maybe it's worth adding to the next self-hosted release notes:
• sentry containers now run directly as sentry user, without root+gosu to sentry (#4535).
• sentry and snuba now have similar approach with healthchecks - via python script (#4539).
• upgraded debian in base image from 12 to 13 (getsentry/sentry#126031).
• started creating -distroless image variant (getsentry/sentry#126030).
some stats
• debian 12 vs 13: getsentry/sentry#126031 (comment).
• normal debian 13 image vs distroless: getsentry/sentry#126030 (comment).
tested all of this on our self-hosted-lol:
• healthchecks work #4539 (comment).
• did a quick run of distroless variant with a throwaway branch, which bypassed some minor bash entrypoint issues that we yet to decide - no issues 🎉 .
If you don't know yet, sentry has a RFC process in which Alex submitted one for distroless: getsentry/rfcs#157
zweizeichen commentedon Oct 8, 2026
Sidenote: awesome work with the past few releases! The reduction in containers/deployment complexity is a very nice direction, looking forward to distroless containers and S3-less nodestore! 🥳
aldy505 commentedon Oct 15, 2026
Release notes draft
Caution
This version upgrades Postgres 14 to 18. If you are very concerned about your data, make sure to take a snapshot of your server before upgrading!
Postgres 18 Upgrade
We've finally moved off our very old Postgres 14 and onto Postgres 18. This upgrade includes a breaking change in how Postgres data is stored. See docker-library/postgres#1259 for the details.
If you ever encountered a problem, come to Discord for direct help.
Going Distroless
Distroless images are even more minimal (in terms of image size and included packages) than
debian:slim, and in some cases than Alpine. They contain only the application and its runtime dependencies, with no OS shell or package manager. That leaves far less to flag when you scan with Trivy or similar tools. They’re also smaller, which means faster image downloads and less disk space used on your host.Sentry's RFC process is how this work got started. Alex, our security engineer, submitted an RFC for distroless, and the changes below follow from it:
sentryuser directly. Containers no longer start as root and drop privileges throughgosu. This removes a moving part, and there's no root process to worry about (self-hosted#4535).-distrolessimage variant (sentry#126030). For a comparison against the standard Debian 13 image, see this comment.We ran a quick test of the distroless variant from a throwaway branch. That branch sidestepped a few minor bash entrypoint issues we haven’t settled on yet, and the run itself had no problems. The distroless sentry image isn’t the default yet, so you’ll need to opt in via
:nightly-distrolessto use it.Here’s where each service stands:
Experimental Features to Try
organizations:attribute-managementenables the Settings > Attributes browser and editor page.organizations:relay-automatic-json-expansionandorganizations:explore-automatic-json-expansion-uicontrol the expansion config. The flag names don't say much, but they let you expand JSON logs, which is worth a look.Other Notable Things
jqimage ourselves. We use the official one now (self-hosted#4547).SENTRY_BUCKET_PROFILEShas changed. If you use external storage (S3-compatible or GCS), update your configuration before upgrading.We're always happy to chat about setups, upgrades, or whatever's giving you trouble. Come find us on Discord.