Proposal: Remove the badger cli from the Dgraph Docker image

[matthewmcneely]

This poll aims to understand if you rely on the badger cli to be present in the Dgraph Docker image.

Including badger in our Dgraph Docker image causes Trivy (and other CVE checkers) to fail with a few HIGH severity security vulnerabilities. The badger API has its golang version set a few versions back so that projects using older go runtimes remain compatible. Older golang runtimes do have some known vulnerabilities.

[rahst12]

We use the badgerdb cli for advanced debugging.

[matthewmcneely]

You can still download it from badger releases page, and also each release of Dgraph will still have the badger binary alongside the other release artifacts in the dgraph repo. Will that suffice? As I mentioned in the poll, having it in the image raises CVEs because we still compile badger with an earlier version of go.

[rahst12]

That should work!