From c5c1eadeb18e509a98d1e787206c0438417683fc Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 7 Jul 2026 10:13:55 +0200 Subject: [PATCH] feat: update base image to debian 13 (trixie) (#9973) Co-authored-by: Claude Fable 5 --- Dockerfile | 35 ++++++++++++++++---------------- docker/DockerfileFullEe | 5 ++++- docker/DockerfileSlim | 16 +++++++-------- docker/DockerfileSlimEe | 16 +++++++-------- sandbox-image/Dockerfile.sandbox | 2 +- 5 files changed, 39 insertions(+), 35 deletions(-) diff --git a/Dockerfile b/Dockerfile index df03ffbdc0..cb5cbb57e7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ -ARG DEBIAN_IMAGE=debian:bookworm-slim -ARG RUST_IMAGE=rust:1.93-slim-bookworm +ARG DEBIAN_IMAGE=debian:trixie-slim +ARG RUST_IMAGE=rust:1.93-slim-trixie -FROM debian:bookworm-slim AS nsjail +FROM debian:trixie-slim AS nsjail WORKDIR /nsjail @@ -9,12 +9,12 @@ RUN apt-get -y update \ && apt-get install -y \ bison=2:3.8.* \ flex=2.6.* \ - g++=4:12.2.* \ - gcc=4:12.2.* \ - git=1:2.39.* \ + g++=4:14.2.* \ + gcc=4:14.2.* \ + git=1:2.47.* \ libprotobuf-dev=3.21.* \ libnl-route-3-dev=3.7.* \ - make=4.3-4.1 \ + make=4.4.* \ pkg-config=1.8.* \ protobuf-compiler=3.21.* @@ -44,7 +44,7 @@ FROM rust_base AS windmill_duckdb_ffi_internal_builder WORKDIR /windmill-duckdb-ffi-internal -RUN apt-get update && apt-get install -y clang=1:14.0-55.* libclang-dev=1:14.0-55.* cmake=3.25.* && \ +RUN apt-get update && apt-get install -y clang=1:19.0* libclang-dev=1:19.0* cmake=3.31.* && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* @@ -98,7 +98,7 @@ ARG features="" COPY --from=planner /windmill/recipe.json recipe.json -RUN apt-get update && apt-get install -y libxml2-dev=2.9.* libxmlsec1-dev=1.2.* libkrb5-dev libsasl2-dev libcurl4-openssl-dev clang=1:14.0-55.* libclang-dev=1:14.0-55.* cmake=3.25.* && \ +RUN apt-get update && apt-get install -y libxml2-dev=2.12.* libxmlsec1-dev=1.2.* libkrb5-dev libsasl2-dev libcurl4-openssl-dev clang=1:19.0* libclang-dev=1:19.0* cmake=3.31.* && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* @@ -135,7 +135,6 @@ FROM ${DEBIAN_IMAGE} ARG TARGETPLATFORM ARG POWERSHELL_VERSION=7.5.0 -ARG POWERSHELL_DEB_VERSION=7.5.0-1 ARG KUBECTL_VERSION=1.28.7 ARG HELM_VERSION=3.14.3 # NOTE: If changing, also change go version in workspace dependencies template at WorkspaceDependenciesEditor.svelte @@ -183,12 +182,14 @@ RUN if [ "$WITH_GIT" = "true" ]; then \ && rm -rf /var/lib/apt/lists/*; \ else echo 'Building the image without git'; fi; +# PowerShell ships as a tarball: the upstream .deb depends on libicu<=74 which no longer exists in trixie RUN if [ "$WITH_POWERSHELL" = "true" ]; then \ - if [ "$TARGETPLATFORM" = "linux/amd64" ]; then apt-get update -y && apt install libicu72 -y && wget -O 'pwsh.deb' "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell_${POWERSHELL_DEB_VERSION}.deb_amd64.deb" && apt-get clean \ - && rm -rf /var/lib/apt/lists/* && \ - dpkg --install 'pwsh.deb' && \ - rm 'pwsh.deb'; \ - elif [ "$TARGETPLATFORM" = "linux/arm64" ]; then apt-get update -y && apt install libicu72 -y && wget -O powershell.tar.gz "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell-${POWERSHELL_VERSION}-linux-arm64.tar.gz" && apt-get clean \ + case "$TARGETPLATFORM" in \ + "linux/amd64") pwsh_arch=x64 ;; \ + "linux/arm64") pwsh_arch=arm64 ;; \ + *) pwsh_arch="" ;; \ + esac; \ + if [ -n "$pwsh_arch" ]; then apt-get update -y && apt install libicu76 -y && wget -O powershell.tar.gz "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell-${POWERSHELL_VERSION}-linux-${pwsh_arch}.tar.gz" && apt-get clean \ && rm -rf /var/lib/apt/lists/* && \ mkdir -p /opt/microsoft/powershell/7 && \ tar zxf powershell.tar.gz -C /opt/microsoft/powershell/7 && \ @@ -292,7 +293,7 @@ RUN bun install -g windmill-cli \ RUN curl -fsSL https://claude.ai/install.sh | bash \ && cp /root/.local/share/claude/versions/* /usr/bin/claude -COPY --from=php:8.3.30-cli-bookworm /usr/local/bin/php /usr/bin/php +COPY --from=php:8.3.30-cli-trixie /usr/local/bin/php /usr/bin/php COPY --from=composer:2.9.5 /usr/bin/composer /usr/bin/composer # add the docker client to call docker from a worker if enabled @@ -303,7 +304,7 @@ ENV CARGO_HOME="/tmp/windmill/cache/cargo" ENV LD_LIBRARY_PATH="." # nsjail runtime deps and binary -RUN apt-get update && apt-get install -y --no-install-recommends libprotobuf32 libnl-route-3-200 libnl-3-200 \ +RUN apt-get update && apt-get install -y --no-install-recommends libprotobuf32t64 libnl-route-3-200 libnl-3-200 \ && apt-get clean && rm -rf /var/lib/apt/lists/* COPY --from=nsjail /nsjail/nsjail /bin/nsjail diff --git a/docker/DockerfileFullEe b/docker/DockerfileFullEe index 3fbb06da71..b82a45b89a 100644 --- a/docker/DockerfileFullEe +++ b/docker/DockerfileFullEe @@ -35,7 +35,10 @@ RUN wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh \ # Oracle DB Client COPY --from=oracledb-client /opt/oracle/23/lib /opt/oracle/23/lib -RUN apt-get -y update && apt-get install -y libaio1 +# libaio1t64 only ships libaio.so.1t64; Oracle instantclient loads libaio.so.1, so add a compat symlink +RUN apt-get -y update && apt-get install -y libaio1t64 \ + && libaio="$(find /usr/lib -name 'libaio.so.1t64' -print -quit)" \ + && ln -s "$(basename "$libaio")" "$(dirname "$libaio")/libaio.so.1" RUN echo /opt/oracle/23/lib > /etc/ld.so.conf.d/oracle-instantclient.conf && ldconfig # Nushell diff --git a/docker/DockerfileSlim b/docker/DockerfileSlim index ef3fb1261f..31e42cb2c9 100644 --- a/docker/DockerfileSlim +++ b/docker/DockerfileSlim @@ -1,6 +1,6 @@ -ARG DEBIAN_IMAGE=debian:bookworm-slim +ARG DEBIAN_IMAGE=debian:trixie-slim -FROM debian:bookworm-slim AS nsjail +FROM debian:trixie-slim AS nsjail WORKDIR /nsjail @@ -9,12 +9,12 @@ RUN apt-get -y update \ bison=2:3.8.* \ ca-certificates \ flex=2.6.* \ - g++=4:12.2.* \ - gcc=4:12.2.* \ - git=1:2.39.* \ + g++=4:14.2.* \ + gcc=4:14.2.* \ + git=1:2.47.* \ libprotobuf-dev=3.21.* \ libnl-route-3-dev=3.7.* \ - make=4.3-4.1 \ + make=4.4.* \ pkg-config=1.8.* \ protobuf-compiler=3.21.* \ && apt-get clean \ @@ -39,7 +39,7 @@ ENV PATH=/usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH # Install system dependencies RUN apt-get update \ - && apt-get install -y --no-install-recommends ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release libgnutls30 libgcrypt20 \ + && apt-get install -y --no-install-recommends ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release libgnutls30t64 libgcrypt20 \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* @@ -86,7 +86,7 @@ COPY --from=docker:29-dind /usr/local/bin/docker /usr/local/bin/ # nsjail runtime deps and binary RUN apt-get update \ - && apt-get install -y --no-install-recommends libprotobuf32 libnl-route-3-200 libnl-3-200 \ + && apt-get install -y --no-install-recommends libprotobuf32t64 libnl-route-3-200 libnl-3-200 \ && apt-get clean && rm -rf /var/lib/apt/lists/* COPY --from=nsjail /nsjail/nsjail /bin/nsjail diff --git a/docker/DockerfileSlimEe b/docker/DockerfileSlimEe index 3e36d67a12..e850718469 100644 --- a/docker/DockerfileSlimEe +++ b/docker/DockerfileSlimEe @@ -1,6 +1,6 @@ -ARG DEBIAN_IMAGE=debian:bookworm-slim +ARG DEBIAN_IMAGE=debian:trixie-slim -FROM debian:bookworm-slim AS nsjail +FROM debian:trixie-slim AS nsjail WORKDIR /nsjail @@ -9,12 +9,12 @@ RUN apt-get -y update \ bison=2:3.8.* \ ca-certificates \ flex=2.6.* \ - g++=4:12.2.* \ - gcc=4:12.2.* \ - git=1:2.39.* \ + g++=4:14.2.* \ + gcc=4:14.2.* \ + git=1:2.47.* \ libprotobuf-dev=3.21.* \ libnl-route-3-dev=3.7.* \ - make=4.3-4.1 \ + make=4.4.* \ pkg-config=1.8.* \ protobuf-compiler=3.21.* \ && apt-get clean \ @@ -39,7 +39,7 @@ ENV PATH=/usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH # Install system dependencies RUN apt-get update \ - && apt-get install -y --no-install-recommends ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release libgnutls30 libgcrypt20 \ + && apt-get install -y --no-install-recommends ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release libgnutls30t64 libgcrypt20 \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* @@ -86,7 +86,7 @@ COPY --from=docker:29-dind /usr/local/bin/docker /usr/local/bin/ # nsjail runtime deps and binary RUN apt-get update \ - && apt-get install -y --no-install-recommends libprotobuf32 libnl-route-3-200 libnl-3-200 \ + && apt-get install -y --no-install-recommends libprotobuf32t64 libnl-route-3-200 libnl-3-200 \ && apt-get clean && rm -rf /var/lib/apt/lists/* COPY --from=nsjail /nsjail/nsjail /bin/nsjail diff --git a/sandbox-image/Dockerfile.sandbox b/sandbox-image/Dockerfile.sandbox index 7c9ca181a4..7666366720 100644 --- a/sandbox-image/Dockerfile.sandbox +++ b/sandbox-image/Dockerfile.sandbox @@ -1,4 +1,4 @@ -FROM debian:bookworm-slim +FROM debian:trixie-slim # ── Minimal system deps ────────────────────────────────────────────────────── RUN apt-get update && apt-get install -y --no-install-recommends \