This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch hardened-python-base-images in repository https://gitbox.apache.org/repos/asf/airflow.git
commit 4beba5dfa8cd76548c2b16e818422674c88078a7 Author: Jarek Potiuk <[email protected]> AuthorDate: Sat Oct 10 16:39:40 2026 +0100 Refresh the shared library cache after apt runs in hardened images The hardened images ship libc-bin without its dpkg trigger, so libraries installed by apt stayed invisible to ctypes.util.find_library() - the CI image's docs build failed with "The 'enchant' C library was not found". A dpkg post-invoke hook runs ldconfig after every apt run, also in images extending ours. Generated-by: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014np1fVAxHmGaBFt3qebJ8x --- Dockerfile | 12 ++++++++++++ Dockerfile.ci | 12 ++++++++++++ scripts/docker/install_os_dependencies.sh | 12 ++++++++++++ 3 files changed, 36 insertions(+) diff --git a/Dockerfile b/Dockerfile index 5bc94168066..2066ae8ccd4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -307,6 +307,16 @@ function keep_image_conffiles() { printf '%s\n' force-confdef force-confold > /etc/dpkg/dpkg.cfg.d/airflow-keep-conffiles } +function refresh_ldconfig_after_dpkg() { + # The hardened base images ship libc-bin without its dpkg trigger, so installing a shared library + # does not refresh the ldconfig cache and ctypes.util.find_library() - which reads that cache - + # cannot find it (for example pyenchant's "The 'enchant' C library was not found"). The hook covers + # every apt run - this build's and those of images extending it. + mkdir -p /etc/apt/apt.conf.d + echo 'DPkg::Post-Invoke { "if [ -x /sbin/ldconfig ]; then /sbin/ldconfig; fi"; };' \ + > /etc/apt/apt.conf.d/99airflow-ldconfig +} + function restore_debian_base_files() { # The hardened base images ship a minimal /etc, but Debian maintainer scripts assume the files # a stock Debian has: sasl2-bin chowns its run directory to the "sasl" group from base-passwd, @@ -339,6 +349,7 @@ function restore_debian_base_files() { function install_debian_dev_dependencies() { if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then keep_image_conffiles + refresh_ldconfig_after_dpkg fi apt-get update apt-get install -yqq --no-install-recommends apt-utils >/dev/null 2>&1 @@ -588,6 +599,7 @@ function install_python() { function install_debian_runtime_dependencies() { if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then keep_image_conffiles + refresh_ldconfig_after_dpkg fi apt-get update apt-get install --no-install-recommends -yqq apt-utils >/dev/null 2>&1 diff --git a/Dockerfile.ci b/Dockerfile.ci index e0ea624a9ff..42c8fb507dd 100644 --- a/Dockerfile.ci +++ b/Dockerfile.ci @@ -243,6 +243,16 @@ function keep_image_conffiles() { printf '%s\n' force-confdef force-confold > /etc/dpkg/dpkg.cfg.d/airflow-keep-conffiles } +function refresh_ldconfig_after_dpkg() { + # The hardened base images ship libc-bin without its dpkg trigger, so installing a shared library + # does not refresh the ldconfig cache and ctypes.util.find_library() - which reads that cache - + # cannot find it (for example pyenchant's "The 'enchant' C library was not found"). The hook covers + # every apt run - this build's and those of images extending it. + mkdir -p /etc/apt/apt.conf.d + echo 'DPkg::Post-Invoke { "if [ -x /sbin/ldconfig ]; then /sbin/ldconfig; fi"; };' \ + > /etc/apt/apt.conf.d/99airflow-ldconfig +} + function restore_debian_base_files() { # The hardened base images ship a minimal /etc, but Debian maintainer scripts assume the files # a stock Debian has: sasl2-bin chowns its run directory to the "sasl" group from base-passwd, @@ -275,6 +285,7 @@ function restore_debian_base_files() { function install_debian_dev_dependencies() { if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then keep_image_conffiles + refresh_ldconfig_after_dpkg fi apt-get update apt-get install -yqq --no-install-recommends apt-utils >/dev/null 2>&1 @@ -524,6 +535,7 @@ function install_python() { function install_debian_runtime_dependencies() { if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then keep_image_conffiles + refresh_ldconfig_after_dpkg fi apt-get update apt-get install --no-install-recommends -yqq apt-utils >/dev/null 2>&1 diff --git a/scripts/docker/install_os_dependencies.sh b/scripts/docker/install_os_dependencies.sh index e8126c43f2c..649e490339d 100644 --- a/scripts/docker/install_os_dependencies.sh +++ b/scripts/docker/install_os_dependencies.sh @@ -218,6 +218,16 @@ function keep_image_conffiles() { printf '%s\n' force-confdef force-confold > /etc/dpkg/dpkg.cfg.d/airflow-keep-conffiles } +function refresh_ldconfig_after_dpkg() { + # The hardened base images ship libc-bin without its dpkg trigger, so installing a shared library + # does not refresh the ldconfig cache and ctypes.util.find_library() - which reads that cache - + # cannot find it (for example pyenchant's "The 'enchant' C library was not found"). The hook covers + # every apt run - this build's and those of images extending it. + mkdir -p /etc/apt/apt.conf.d + echo 'DPkg::Post-Invoke { "if [ -x /sbin/ldconfig ]; then /sbin/ldconfig; fi"; };' \ + > /etc/apt/apt.conf.d/99airflow-ldconfig +} + function restore_debian_base_files() { # The hardened base images ship a minimal /etc, but Debian maintainer scripts assume the files # a stock Debian has: sasl2-bin chowns its run directory to the "sasl" group from base-passwd, @@ -250,6 +260,7 @@ function restore_debian_base_files() { function install_debian_dev_dependencies() { if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then keep_image_conffiles + refresh_ldconfig_after_dpkg fi apt-get update apt-get install -yqq --no-install-recommends apt-utils >/dev/null 2>&1 @@ -499,6 +510,7 @@ function install_python() { function install_debian_runtime_dependencies() { if [[ "${AIRFLOW_IMAGE_FLAVOR}" == "hardened" ]]; then keep_image_conffiles + refresh_ldconfig_after_dpkg fi apt-get update apt-get install --no-install-recommends -yqq apt-utils >/dev/null 2>&1
