From e1fe8354e9908244322467d9b51bb532afbbb7a7 Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Wed, 22 Oct 2025 21:48:57 +0000
Subject: [PATCH] Ensure Docker agent builds stay static (#597)

---
 docs/DOCKER_MONITORING.md                                | 4 +++-
 frontend-modern/src/components/Settings/DockerAgents.tsx | 5 ++++-
 scripts/build-release.sh                                 | 3 +++
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/docs/DOCKER_MONITORING.md b/docs/DOCKER_MONITORING.md
index 18399ec..659658f 100644
--- a/docs/DOCKER_MONITORING.md
+++ b/docs/DOCKER_MONITORING.md
@@ -29,11 +29,13 @@ Grab the `pulse-docker-agent` binary from the release assets (or build it yourse
 ```bash
 # Build from source
 cd /opt/pulse
-GOOS=linux GOARCH=amd64 go build -o pulse-docker-agent ./cmd/pulse-docker-agent
+CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o pulse-docker-agent ./cmd/pulse-docker-agent
 ```
 
 Copy the binary to your Docker host (e.g. `/usr/local/bin/pulse-docker-agent`) and make it executable.
 
+> **Why `CGO_ENABLED=0`?** Building a fully static binary ensures the agent runs on hosts still using older glibc releases (for example Debian 11 with glibc 2.31).
+
 ### Quick install from your Pulse server
 
 Use the bundled installation script (ships with Pulse v4.22.0+) to deploy and manage the agent. Replace the token placeholder with an API token generated in **Settings → Security**. Create a dedicated token for each Docker host so you can revoke individual credentials without touching others—sharing one token across many hosts makes incident response much harder.
diff --git a/frontend-modern/src/components/Settings/DockerAgents.tsx b/frontend-modern/src/components/Settings/DockerAgents.tsx
index b038e3b..d0955ba 100644
--- a/frontend-modern/src/components/Settings/DockerAgents.tsx
+++ b/frontend-modern/src/components/Settings/DockerAgents.tsx
@@ -786,9 +786,12 @@ WantedBy=multi-user.target`;
                     <code>
                       cd /opt/pulse
                       <br />
-                      GOOS=linux GOARCH=amd64 go build -o pulse-docker-agent ./cmd/pulse-docker-agent
+                      CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o pulse-docker-agent ./cmd/pulse-docker-agent
                     </code>
                   </div>
+                  <p class="text-xs text-gray-500 dark:text-gray-400">
+                    Building with <code class="font-mono text-[11px]">CGO_ENABLED=0</code> keeps the binary fully static so it runs on hosts with older glibc (e.g. Debian 11).
+                  </p>
                   <p class="font-medium text-gray-900 dark:text-gray-100">2. Copy to host</p>
                   <div class="rounded bg-gray-900 p-3 font-mono text-xs text-gray-100 dark:bg-gray-950">
                     <code>
diff --git a/scripts/build-release.sh b/scripts/build-release.sh
index 18b1671..6af6f3d 100755
--- a/scripts/build-release.sh
+++ b/scripts/build-release.sh
@@ -10,6 +10,9 @@ if [ -x /usr/local/go/bin/go ]; then
     export PATH=/usr/local/go/bin:$PATH
 fi
 
+# Force static binaries so release artifacts run on older glibc hosts
+export CGO_ENABLED=0
+
 VERSION=${1:-$(cat VERSION)}
 BUILD_DIR="build"
 RELEASE_DIR="release"