From 7ac0062d7064b7263fe43dfb01a509db323e5a2b Mon Sep 17 00:00:00 2001 From: Michael Sproul Date: Mon, 7 Sep 2026 15:43:14 +1000 Subject: [PATCH 1/3] Update Docker builder to Debian Bookworm Keep Rust at 1.88.0 while moving the builder off Bullseye to avoid the failing Debian security package downloads. Update the Ubuntu runtime to 24.04 so its glibc is newer than the builder's. --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 8cc20ab000f..1e19b5bce20 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM rust:1.88.0-bullseye AS builder +FROM rust:1.88.0-bookworm AS builder RUN apt-get update && apt-get -y upgrade && apt-get install -y cmake libclang-dev ARG FEATURES ARG PROFILE=release @@ -15,7 +15,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \ --mount=type=cache,target=/lighthouse/target \ make -FROM ubuntu:22.04 +FROM ubuntu:24.04 RUN apt-get update && apt-get -y upgrade && apt-get install -y --no-install-recommends \ libssl-dev \ ca-certificates \ From 7263b3e427569bfeb545855283252138e46311dd Mon Sep 17 00:00:00 2001 From: antondlr Date: Mon, 7 Sep 2026 13:41:49 +0200 Subject: [PATCH 2/3] Move lcli Docker builder to Debian Bookworm `lcli/Dockerfile` carries the same bullseye pin as the main `Dockerfile`, so it breaks the same way now that Debian 11 has reached LTS EOL. Apply the identical fix: bookworm builder, and Ubuntu 24.04 runtime so its glibc is newer than the builder's. Not built by CI (`docker.yml` uses `lcli/Dockerfile.cross`), but broken for local builds. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Qny4QevtjCbyAyAB7rT7M7 --- lcli/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lcli/Dockerfile b/lcli/Dockerfile index f1e4bd8ee04..5508c0a121b 100644 --- a/lcli/Dockerfile +++ b/lcli/Dockerfile @@ -1,13 +1,13 @@ # `lcli` requires the full project to be in scope, so this should be built either: # - from the `lighthouse` dir with the command: `docker build -f ./lcli/Dockerflie .` # - from the current directory with the command: `docker build -f ./Dockerfile ../` -FROM rust:1.88.0-bullseye AS builder +FROM rust:1.88.0-bookworm AS builder RUN apt-get update && apt-get -y upgrade && apt-get install -y cmake libclang-dev COPY . lighthouse ARG FEATURES ENV FEATURES=$FEATURES RUN cd lighthouse && make install-lcli -FROM ubuntu:22.04 +FROM ubuntu:24.04 RUN apt-get update && apt-get -y upgrade && apt-get clean && rm -rf /var/lib/apt/lists/* COPY --from=builder /usr/local/cargo/bin/lcli /usr/local/bin/lcli From 7163692637aa7504e5df2b70deacd65b7bd1ad5a Mon Sep 17 00:00:00 2001 From: antondlr Date: Mon, 7 Sep 2026 13:49:49 +0200 Subject: [PATCH 3/3] Move reproducible builds to Debian Bookworm The reproducible build path still pins `rust:1.88-bullseye` by digest in three places, and pins exact bullseye package versions. Debian 11 reached LTS EOL on 2026-08-31, so `apt-get update` in this image fails once the `bullseye-security` Release file expires. Bump the per-arch digests to the current `rust:1.88-bookworm` and repin the build dependencies to their bookworm versions. Rust stays at 1.88. Verified both pinned images install the pinned packages cleanly: amd64 Debian 12, rustc 1.88.0, cmake 3.25.1, glibc 2.36 arm64 Debian 12, rustc 1.88.0, cmake 3.25.1, glibc 2.36 This also aligns the builder with the `distroless/cc-debian12` runtime, which previously ran a bullseye-built binary against a bookworm userland. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Qny4QevtjCbyAyAB7rT7M7 --- .github/workflows/docker-reproducible.yml | 4 ++-- Dockerfile.reproducible | 6 +++--- Makefile | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/docker-reproducible.yml b/.github/workflows/docker-reproducible.yml index 7e46fc691b1..e1733051ae0 100644 --- a/.github/workflows/docker-reproducible.yml +++ b/.github/workflows/docker-reproducible.yml @@ -46,13 +46,13 @@ jobs: - arch: amd64 rust_target: x86_64-unknown-linux-gnu rust_image: >- - rust:1.88-bullseye@sha256:8e3c421122bf4cd3b2a866af41a4dd52d87ad9e315fd2cb5100e87a7187a9816 + rust:1.88-bookworm@sha256:4727898c104ecd2e22d780925832502faee9fe4e70581b8572af081370b315a0 platform: linux/amd64 runner: ubuntu-22.04 - arch: arm64 rust_target: aarch64-unknown-linux-gnu rust_image: >- - rust:1.88-bullseye@sha256:8b22455a7ce2adb1355067638284ee99d21cc516fab63a96c4514beaf370aa94 + rust:1.88-bookworm@sha256:8aa70d1416cf5b1cff4b95ec6c57f1c5e4e649a3b53d616a26695cda6fbb46bc platform: linux/arm64 runner: ubuntu-22.04-arm runs-on: ${{ matrix.runner }} diff --git a/Dockerfile.reproducible b/Dockerfile.reproducible index 903515373f8..d460a6b5875 100644 --- a/Dockerfile.reproducible +++ b/Dockerfile.reproducible @@ -1,9 +1,9 @@ -# Define the Rust image as an argument with a default to x86_64 Rust 1.88 image based on Debian Bullseye -ARG RUST_IMAGE="rust:1.88-bullseye@sha256:8e3c421122bf4cd3b2a866af41a4dd52d87ad9e315fd2cb5100e87a7187a9816" +# Define the Rust image as an argument with a default to x86_64 Rust 1.88 image based on Debian Bookworm +ARG RUST_IMAGE="rust:1.88-bookworm@sha256:4727898c104ecd2e22d780925832502faee9fe4e70581b8572af081370b315a0" FROM ${RUST_IMAGE} AS builder # Install specific version of the build dependencies -RUN apt-get update && apt-get install -y libclang-dev=1:11.0-51+nmu5 cmake=3.18.4-2+deb11u1 libjemalloc-dev=5.2.1-3 +RUN apt-get update && apt-get install -y libclang-dev=1:14.0-55.7~deb12u1 cmake=3.25.1-1 libjemalloc-dev=5.3.0-1 ARG RUST_TARGET="x86_64-unknown-linux-gnu" diff --git a/Makefile b/Makefile index 379b362f52a..fc8c837d2cc 100644 --- a/Makefile +++ b/Makefile @@ -117,8 +117,8 @@ JEMALLOC_OVERRIDE = /usr/lib/$(JEMALLOC_LIB_ARCH)-linux-gnu/libjemalloc.a RUST_TARGET ?= x86_64-unknown-linux-gnu # Default images for different architectures -RUST_IMAGE_AMD64 ?= rust:1.88-bullseye@sha256:8e3c421122bf4cd3b2a866af41a4dd52d87ad9e315fd2cb5100e87a7187a9816 -RUST_IMAGE_ARM64 ?= rust:1.88-bullseye@sha256:8b22455a7ce2adb1355067638284ee99d21cc516fab63a96c4514beaf370aa94 +RUST_IMAGE_AMD64 ?= rust:1.88-bookworm@sha256:4727898c104ecd2e22d780925832502faee9fe4e70581b8572af081370b315a0 +RUST_IMAGE_ARM64 ?= rust:1.88-bookworm@sha256:8aa70d1416cf5b1cff4b95ec6c57f1c5e4e649a3b53d616a26695cda6fbb46bc .PHONY: build-reproducible build-reproducible: ## Build the lighthouse binary into `target` directory with reproducible builds