v6.19.x images are not available on Docker hub

[vsviridov]

v6.19.x images are not available on Docker hub. I've received an email from my instance prompting me to upgrade because of security vulnerability, but the images are not available.

[markstos]

There's discussion of an alternate image being worked on here:

https://forum.ghost.org/t/self-hosters-left-vulnerable-to-xss-vuln-due-to-second-class-docker-support/61674/19

[rusty1281]

Where are we running away? The official fix was pushed 2h ago, and the community here usually updates within 24h.

Also recent hiccups were due to some changes in the upstream (read the closed case) that were fixed in matter of days.

I’m sure the 6.19.1 version will be compiled soon.

Just my2c

[vsviridov]

6.19.0 is out for 3 days and there's not an image for it.

…

On Mon, Feb 16, 2026, 11:11 Rusty ***@***.***> wrote: *rusty1281* left a comment (docker-library/ghost#462) <#462 (comment)> Where are we running away? The official fix was pushed 2h ago, and the community here usually updates within 24h. Also recent hiccups were due to some changes in the upstream (read the closed case) that were fixed in matter of days. I’m sure the 6.19.1 version will be compiled soon. Just my2c — Reply to this email directly, view it on GitHub <#462 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABWD5HS27XLT5OI4GJSJNT4MII4JAVCNFSM6AAAAACVKECWXCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTSMJQGE2TCOBWHA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[markstos]

The alternative build is distroless for improved security and also drops gosu as an unnecessary dep. Work is in progress to automate those builds when Ghost releases as well.

[curiositry]

Based on the language, and the fact every self-hoster got an email, it seems that this vulnerability is more serious / easy to exploit than others.

Also, I could see a flood of vulnerability scanners in my logs, which is normal, but a lot more scary when there’s something to find.

I have shut down my site rather than leave it vulnerable.

I'm losing out on a lot of traffic, and hope the image is patched soon 🤞

[muratcorlu]

@JohnONolan Please act on this. Relying on that "unofficial" Docker image harms Ghost's credibility very badly.

@markstos Alternative build will not fix this issue. This time everyone will rely on another maintainer.

Ghost needs to own that image, and a Docker image should be automatically provided as part of Docker release pipeline, on Github and/or Docker Hub.

[curiositry]

Looks like @tianon has reviewed and merged, so this should be available shortly?

docker-library/official-images#20860

Edit: build has finished, and it’s now available on Docker hub, and I’m running it.

[JohnONolan]

@muratcorlu Thank you for the ping - you're right. We will fix it:
https://forum.ghost.org/t/self-hosters-left-vulnerable-to-xss-vuln-due-to-second-class-docker-support/61674/38