build: switch base images from Alpine to Debian Slim - #3694
Conversation
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3694 +/- ##
==========================================
+ Coverage 79.30% 79.32% +0.02%
==========================================
Files 885 885
Lines 65365 65365
Branches 2543 2591 +48
==========================================
+ Hits 51838 51853 +15
+ Misses 12859 12844 -15
Partials 668 668
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| - **Python**: We support versions in bugfix and security status as defined by the [Python Release Cycle](https://devguide.python.org/versions/). | ||
|
|
||
| Our Docker containers are built on [Alpine Linux](https://alpinelinux.org/releases/) base images. The versions of Ruby and Python available in our containers are dependent on what is packaged in the Alpine releases. Our current Alpine version is [3.23](https://alpinelinux.org/posts/Alpine-3.23.0-released.html) which uses Ruby 3.4 and Python 3.12. | ||
| Our Docker containers are built on [Debian](https://www.debian.org/releases/) slim base images. The version of Python available in our containers is dependent on what is packaged in the Debian release, while Ruby comes from the official `ruby` slim image. Our current Debian release is [trixie](https://www.debian.org/releases/trixie/) which uses Ruby 3.4 and Python 3.13. |
There was a problem hiding this comment.
We're already building on 3.13 so I think that's fine but we should call it out in the release notes
| apk add npm && \ | ||
| RUN apt-get update && \ | ||
| apt-get install -y --no-install-recommends nodejs npm && \ | ||
| npm install --global --ignore-scripts pnpm@10.34.5 && \ |
There was a problem hiding this comment.
This will be pnpm 11 when you resolve conflicts
| ARG OPENC3_DEPENDENCY_REGISTRY=docker.io | ||
| ARG OPENC3_REDIS_IMAGE=valkey/valkey | ||
| ARG OPENC3_REDIS_VERSION=9.1.1-alpine | ||
| ARG OPENC3_REDIS_VERSION=9.1.0 |
There was a problem hiding this comment.
Why backwards? valkey 9.1.1 shoudl exist for debian
There was a problem hiding this comment.
Mistake. Updated to 9.1.1-trixie to be specific.
| rm -rf /usr/local/lib/ruby/gems/*/cache/* /var/lib/apt/lists/* /var/cache/apt/* /tmp/* /var/tmp/* | ||
|
|
||
| RUN ["chown", "-R", "openc3:openc3", "/src/"] | ||
| COPY --chown=${IMAGE_USER}:${IMAGE_GROUP} ./ ./ |
There was a problem hiding this comment.
You're already doing a COPY on line 11. I think this can be removed but keep the chown to reset ownership of Gemfile.lock.
There was a problem hiding this comment.
Removed copy and changed chown to just Gemfile.lock
| rm -rf /usr/local/lib/ruby/gems/*/cache/* /var/lib/apt/lists/* /var/cache/apt/* /tmp/* /var/tmp/* | ||
|
|
||
| RUN ["chown", "-R", "openc3:openc3", "/src/"] | ||
| COPY --chown=${IMAGE_USER}:${IMAGE_GROUP} ./ ./ |
There was a problem hiding this comment.
You're already doing a COPY on line 14. I think this can be removed but keep the chown to reset ownership of Gemfile.lock.
There was a problem hiding this comment.
Removed copy and changed chown to just Gemfile.lock
| RUN apk update && \ | ||
| apk add npm && \ | ||
| RUN apt-get update && \ | ||
| apt-get install -y --no-install-recommends nodejs npm && \ |
There was a problem hiding this comment.
Trixie gives Node v20.19.2. Alpine was Node v24.18.1 and we're Node 24 in all our build actions. Update node to v24.
There was a problem hiding this comment.
Updating to pull node 24 from the official docker node image. Note that UBI is still Node 22.
| && chmod -R 777 /gems/ \ | ||
| && chmod -R 777 /plugins/ \ | ||
| && chmod -R 777 /openc3/ | ||
| && chmod 777 /gems /plugins /openc3 |
There was a problem hiding this comment.
No more -R is behavior change. Line 14 and 34 cover /gems, /openc3/lib, and /openc3gems. But /openc3/python is going to have root owned files. Does this matter?
There was a problem hiding this comment.
gems and plugins are folders for supporting volume mounts so the -R does nothing. /openc3 ownership doesn't matter as it is readable and the container is not writable.
| ARG OPENC3_REDIS_IMAGE=valkey/valkey | ||
| ARG OPENC3_REDIS_VERSION=9.1.1-alpine | ||
| ARG OPENC3_REDIS_VERSION=9.1.0 | ||
|
|
There was a problem hiding this comment.
Probably should add the ARG APT_URL=http://deb.debian.org treatment like the other Dockerfiles
| libtool \ | ||
| libxml2-dev \ | ||
| libxslt-dev \ | ||
| openblas-dev \ |
There was a problem hiding this comment.
Claude thinks removing this will break a source build install of numpy/scipy. But I think we're always installing wheels so ok?
There was a problem hiding this comment.
Since not musl we can use binary wheels.
|
I calculated the differences between 7.3.0 and building this branch for image sizes. The results are as follows (compressed / pull size from registry): Here's the uncompressed per image results: However since there are shared layers they don't sum. The total for pulling all the core images works out as: So about a 20% increase. Uncompressed the rootfs on debian is about 100MB bigger and building Ruby from source results in 94MB. The rest is noise. Is there any reason we wouldn't keep redis and buckets on Alpine? There's no real advantage to moving them to debian except for maintainability. We already have independent traefik (Alpine) and tsdb (fedora-minimal) images. |
|
Curious why we don't just support the RHEL UBI images |
| # Not packaged for Debian, so ship the prebuilt release binary per architecture. | ||
| ARG RBSPY_VERSION=0.49.0 | ||
| ARG TARGETARCH | ||
| COPY rbspy-*-unknown-linux-gnu-${RBSPY_VERSION}.tar.gz /tmp/ |
There was a problem hiding this comment.
idk if it belongs in this PR or is a separate issue entirely, but we should be verifying the integrity of any binaries in the repo. Probably worth a separate discussion
|
Ironbank has poor support for ARM64, which is a major factor for not just supporting RHEL UBI. Also UBI tends to have worse package support. |
|
4 participants
Stacked PR 1 of 5 — base:
main. First of a series that splits #3688 into reviewable chunks; please review/land in order.Switches all container base images from Alpine to Debian Slim. Zero bridge coupling — standalone and mergeable on its own; CI is the real proof.
Reviewer focus
build-base→build-essential,libxslt-dev→libxslt1-dev, busyboxnc→netcat-openbsd, droppedlibc6-compat/openblas-dev)GEM_HOMEreset off the official ruby imagesources.listmirror rewritesh→bashshoremanprintfinstead of busyboxecho -e(dash prints-eliterally, breaking the AUTH line)🤖 Generated with Claude Code