This is an automated email from the ASF dual-hosted git repository.
vatsrahul1001 pushed a commit to branch mirror-hardened-images-more-often
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to
refs/heads/mirror-hardened-images-more-often by this push:
new 04ba8acd2df Lower the dhi.io apt pin below 1000 so dependencies can
resolve
04ba8acd2df is described below
commit 04ba8acd2df35ce9018f52a8abfe52250973d0bc
Author: Rahul Vats <[email protected]>
AuthorDate: Fri Oct 30 15:53:33 2026 +0530
Lower the dhi.io apt pin below 1000 so dependencies can resolve
At priority 1001 the Package:* dhi.io preference forces dhi.io's build even
as a downgrade, so apt keeps dhi.io's libpq5 17.11 and postgresql-client-18
(which needs libpq5 >= 18.6 from PGDG) cannot be installed. Below 1000 the
preference still favours dhi.io for the packages it publishes but lets apt take
a newer version from another repository to satisfy a dependency. The forced
"downgrade" the >1000 priority handled no longer arises now the base image is
pinned to a digest CI has pa [...]
---
Dockerfile | 14 +++++++-------
Dockerfile.ci | 14 +++++++-------
docker-stack-docs/build.rst | 4 ++--
scripts/docker/install_os_dependencies.sh | 14 +++++++-------
4 files changed, 23 insertions(+), 23 deletions(-)
diff --git a/Dockerfile b/Dockerfile
index 5137ede8eac..04cbd717f19 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -316,15 +316,15 @@ function prefer_hardened_apt_repository() {
# image ships (docker-hardened-images/catalog#610). Ranking dhi.io above
the default priority of
# 500 makes apt take Docker's build whenever dhi.io publishes the package,
and fall back to Debian
# only when it does not.
- # The priority is above 1000 so that dhi.io's version also wins over one
already installed when it
- # sorts lower: Docker renumbers its builds - "1.0.8-6+dhi2" became
"1.0.8-6+deb13u0+dhi2", which
- # sorts lower - and its repository moves to the new numbers before its
images do. Packages that
- # depend on the renumbered build cannot be installed until apt may
"downgrade" the image's copy
- # to it (docker-hardened-images/catalog#689). The image's packages all
come from dhi.io, so its
- # repository is the authority on their versions.
+ # The priority stays below 1000 so the preference never forces a
downgrade: apt still favours
+ # dhi.io's build of a package it publishes, but may take a newer version
from another repository
+ # when a dependency requires it - for example PGDG's libpq5, which
postgresql-client-18 needs at
+ # ">= 18.6" and dhi.io does not carry. Pinning the base image to a digest
CI has passed on keeps
+ # dhi.io and the image consistent, so the renumbering that once needed a
forced "downgrade" of the
+ # image's copy (docker-hardened-images/catalog#689) no longer arises
within a build.
# The preference covers every apt run - this build's and those of images
extending it.
mkdir -p /etc/apt/preferences.d
- printf 'Package: *\nPin: origin "dhi.io"\nPin-Priority: 1001\n' >
/etc/apt/preferences.d/airflow-prefer-dhi
+ printf 'Package: *\nPin: origin "dhi.io"\nPin-Priority: 999\n' >
/etc/apt/preferences.d/airflow-prefer-dhi
}
function refresh_ldconfig_after_dpkg() {
diff --git a/Dockerfile.ci b/Dockerfile.ci
index 2b1af691e61..e077bf7093b 100644
--- a/Dockerfile.ci
+++ b/Dockerfile.ci
@@ -252,15 +252,15 @@ function prefer_hardened_apt_repository() {
# image ships (docker-hardened-images/catalog#610). Ranking dhi.io above
the default priority of
# 500 makes apt take Docker's build whenever dhi.io publishes the package,
and fall back to Debian
# only when it does not.
- # The priority is above 1000 so that dhi.io's version also wins over one
already installed when it
- # sorts lower: Docker renumbers its builds - "1.0.8-6+dhi2" became
"1.0.8-6+deb13u0+dhi2", which
- # sorts lower - and its repository moves to the new numbers before its
images do. Packages that
- # depend on the renumbered build cannot be installed until apt may
"downgrade" the image's copy
- # to it (docker-hardened-images/catalog#689). The image's packages all
come from dhi.io, so its
- # repository is the authority on their versions.
+ # The priority stays below 1000 so the preference never forces a
downgrade: apt still favours
+ # dhi.io's build of a package it publishes, but may take a newer version
from another repository
+ # when a dependency requires it - for example PGDG's libpq5, which
postgresql-client-18 needs at
+ # ">= 18.6" and dhi.io does not carry. Pinning the base image to a digest
CI has passed on keeps
+ # dhi.io and the image consistent, so the renumbering that once needed a
forced "downgrade" of the
+ # image's copy (docker-hardened-images/catalog#689) no longer arises
within a build.
# The preference covers every apt run - this build's and those of images
extending it.
mkdir -p /etc/apt/preferences.d
- printf 'Package: *\nPin: origin "dhi.io"\nPin-Priority: 1001\n' >
/etc/apt/preferences.d/airflow-prefer-dhi
+ printf 'Package: *\nPin: origin "dhi.io"\nPin-Priority: 999\n' >
/etc/apt/preferences.d/airflow-prefer-dhi
}
function refresh_ldconfig_after_dpkg() {
diff --git a/docker-stack-docs/build.rst b/docker-stack-docs/build.rst
index 43898411239..20218b95253 100644
--- a/docker-stack-docs/build.rst
+++ b/docker-stack-docs/build.rst
@@ -973,8 +973,8 @@ previous images that can matter when you extend or run the
image are:
* **Packages come from Docker's apt repository first.** The image keeps stock
Debian's apt sources beside
``dhi.io``, and ``/etc/apt/preferences.d/airflow-prefer-dhi`` ranks
``dhi.io`` higher, so apt installs
Docker's build of a package whenever ``dhi.io`` publishes it and falls back
to Debian's otherwise - also
- in images that extend it. The priority is above 1000, so ``dhi.io``'s
version replaces the image's copy
- of a package even when it sorts lower, which happens when Docker renumbers
its builds.
+ in images that extend it. The priority stays below 1000, so apt still
favours ``dhi.io``'s build but can
+ take a newer version from another repository when a dependency needs it (for
example PGDG's ``libpq5``).
.. _image-legacy-flavor:
diff --git a/scripts/docker/install_os_dependencies.sh
b/scripts/docker/install_os_dependencies.sh
index e43cde332f3..1a2cf86c466 100644
--- a/scripts/docker/install_os_dependencies.sh
+++ b/scripts/docker/install_os_dependencies.sh
@@ -225,15 +225,15 @@ function prefer_hardened_apt_repository() {
# image ships (docker-hardened-images/catalog#610). Ranking dhi.io above
the default priority of
# 500 makes apt take Docker's build whenever dhi.io publishes the package,
and fall back to Debian
# only when it does not.
- # The priority is above 1000 so that dhi.io's version also wins over one
already installed when it
- # sorts lower: Docker renumbers its builds - "1.0.8-6+dhi2" became
"1.0.8-6+deb13u0+dhi2", which
- # sorts lower - and its repository moves to the new numbers before its
images do. Packages that
- # depend on the renumbered build cannot be installed until apt may
"downgrade" the image's copy
- # to it (docker-hardened-images/catalog#689). The image's packages all
come from dhi.io, so its
- # repository is the authority on their versions.
+ # The priority stays below 1000 so the preference never forces a
downgrade: apt still favours
+ # dhi.io's build of a package it publishes, but may take a newer version
from another repository
+ # when a dependency requires it - for example PGDG's libpq5, which
postgresql-client-18 needs at
+ # ">= 18.6" and dhi.io does not carry. Pinning the base image to a digest
CI has passed on keeps
+ # dhi.io and the image consistent, so the renumbering that once needed a
forced "downgrade" of the
+ # image's copy (docker-hardened-images/catalog#689) no longer arises
within a build.
# The preference covers every apt run - this build's and those of images
extending it.
mkdir -p /etc/apt/preferences.d
- printf 'Package: *\nPin: origin "dhi.io"\nPin-Priority: 1001\n' >
/etc/apt/preferences.d/airflow-prefer-dhi
+ printf 'Package: *\nPin: origin "dhi.io"\nPin-Priority: 999\n' >
/etc/apt/preferences.d/airflow-prefer-dhi
}
function refresh_ldconfig_after_dpkg() {
