[luuvasara]

What

Run apt-get -y upgrade before installing the vDSM packages.

Why

The image copies its entire base from a pinned qemux/qemu tag, which carries over that tag's Debian packages as they were on its build day. Nothing refreshes them when virtual-dsm is rebuilt, so Debian security updates released after the base was built never reach users.

vdsm/virtual-dsm:latest (7.66, base qemux/qemu:7.50) scanned with Trivy today (DB of 2026-10-27):

	latest	rebuilt from master	rebuilt with this PR
Findings	994	994	808
Unique CVEs	454	454	369
…with a fix available	132	132	47
Critical	6	6	2
Debian packages with a fix available	many (curl, openssl, perl, glib, expat, nginx, dnsmasq, python3.13, sqlite, libssh2, xz …)	same	0

The upgrade updated 43 packages. QEMU is left alone because the sid snapshot source is removed in the base, so trixie has nothing newer to offer for it.

The 47 fixable findings that remain are all in the Go binaries /run/host.bin (Go 1.26.5) and /run/boot-logo (Go 1.25.7). They need a rebuild of those projects with a current Go toolchain, which is out of scope here.

Testing

• Built with docker buildx build. No conffile prompts, exit 0.
• Started it with /dev/kvm, an empty /storage and the default URL. It downloaded and installed DSM 7.2.2-72806, booted, the healthcheck reported healthy, and port 5000 served the "Welcome to DSM 7.2" page.

Trade-off

The upgrade lands in the vDSM layer, so the image grows from about 758 MB to 931 MB on disk. Doing the same in the qemux/qemu Dockerfile would avoid that, but it would only help once the pinned base tag is bumped.