Do not UPX-pack FreeSurfer binaries for Docker

[Arshya-Guru]

Since 2.5.4 the image is built on ubuntu:24.04 (UPX 4.22). On hosts running EDR software such as CrowdStrike Falcon, the UPX self-extraction stub is SIGKILLed at launch for several FreeSurfer binaries (mri_add_xform_to_header,
mris_fix_topology), so every recon-surf run fails with what looks like an OOM.
The size saving from packing is ~7 MB on a ~5.5 GB image.

[Copilot]

🔵 Needs a closer look

Official release paths still use a prebuilt FreeSurfer image that may contain UPX-packed binaries.

Pull request overview

This PR disables UPX packing for locally built FreeSurfer binaries to prevent EDR-related launch failures.

Changes:

• Removes the --upx option from the FreeSurfer installation step.
• Preserves optional UPX support for other callers.

File summaries

File	Description
tools/Docker/Dockerfile	Disables UPX packing for locally built FreeSurfer binaries.

Review details

Suppressed comments (1)

tools/Docker/Dockerfile:229

• This only changes the locally built build_freesurfer stage. The documented release path passes --freesurfer_build_image with deepmi/fastsurfer-build:freesurfer741 (tools/Docker/README.md:241), and the quicktest workflow likewise defaults to that prebuilt image (.github/workflows/quicktest.yaml:185-199). Unless that image is rebuilt/published without UPX, or releases are switched to this stage, official images will still copy the already-packed /opt/freesurfer and this fix will not resolve #882.

/install/install_fs_pruned.sh /opt --url $FREESURFER_URL $INSECURE_FLAG

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[m-reuter]

Thanks for the PR and issue. We should drop upx then, but as copilot says, this needs a little more work (on our side) to update caches etc. Also this does not fix #882 completely as it also found missing error propagation in some scripts that need to be checked separately.

[m-reuter]

Merging. Note this only affects builds that compile FreeSurfer from source. Official images copy it from the prebuilt  deepmi/fastsurfer-build:freesurfer741 , which is still packed, so #882 stays open until that is rebuilt.