From cd4e55de7d1760ceaeafe0306b1d1555385f34fb Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Mon, 26 Oct 2026 18:06:25 +0100 Subject: [PATCH] force a fresh apt-get upgrade in docker images via APT_REFRESH (#12026) Co-authored-by: Claude Opus 5.5 --- Dockerfile | 8 ++++++-- docker/DockerfileSlim | 5 ++++- docker/DockerfileSlimEe | 5 ++++- 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 93862fe0b9..7d53a5a58a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -169,8 +169,12 @@ ENV UV_TOOL_DIR=/usr/local/uv ENV PATH /usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH - -RUN apt-get update \ +# The build cache keeps the apt layer while the base image digest and this line are unchanged, so +# Debian security updates are not picked up by later builds. Bump to force a fresh apt-get upgrade; +# bump it in docker/DockerfileSlim and docker/DockerfileSlimEe too. +ARG APT_REFRESH=1 +RUN echo "apt refresh ${APT_REFRESH}" \ + && apt-get update \ && apt-get upgrade -y \ && apt-get install -y --no-install-recommends netbase tzdata ca-certificates wget curl jq unzip build-essential unixodbc xmlsec1 tini gnupg libargon2-1 \ && if echo "$features" | grep -q "ee"; then apt-get install -y --no-install-recommends libsasl2-modules-gssapi-mit krb5-user; fi \ diff --git a/docker/DockerfileSlim b/docker/DockerfileSlim index 0a1e5a0c42..daeb64b637 100644 --- a/docker/DockerfileSlim +++ b/docker/DockerfileSlim @@ -44,7 +44,10 @@ ENV UV_TOOL_DIR=/usr/local/uv ENV PATH=/usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH # Install system dependencies -RUN apt-get update \ +# Bump to force a fresh apt-get upgrade past the build cache; keep in step with ../Dockerfile. +ARG APT_REFRESH=1 +RUN echo "apt refresh ${APT_REFRESH}" \ + && apt-get update \ && apt-get upgrade -y \ && apt-get install -y --no-install-recommends ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release libgnutls30t64 libgcrypt20 \ && apt-get clean \ diff --git a/docker/DockerfileSlimEe b/docker/DockerfileSlimEe index 46d0d2d98f..3edff33038 100644 --- a/docker/DockerfileSlimEe +++ b/docker/DockerfileSlimEe @@ -44,7 +44,10 @@ ENV UV_TOOL_DIR=/usr/local/uv ENV PATH=/usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH # Install system dependencies -RUN apt-get update \ +# Bump to force a fresh apt-get upgrade past the build cache; keep in step with ../Dockerfile. +ARG APT_REFRESH=1 +RUN echo "apt refresh ${APT_REFRESH}" \ + && apt-get update \ && apt-get upgrade -y \ && apt-get install -y --no-install-recommends ca-certificates wget curl git jq unzip unixodbc xmlsec1 gnupg lsb-release libgnutls30t64 libgcrypt20 \ && apt-get clean \