From 5e434b7dfa1dac5f480b850b1ffd87344fc3ce03 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 18:58:00 +0000 Subject: [PATCH] Bump the images group across 2 directories with 4 updates Bumps the images group with 2 updates in the / directory: debian and alpine. Bumps the images group with 2 updates in the /web directory: oven/bun and node. Updates `debian` from `abd67ff` to `8820086` Updates `alpine` from 3.20 to 3.24 Updates `oven/bun` from 1.3.14 to 1.4.2 Updates `node` from 22-bookworm-slim to 26-bookworm-slim --- updated-dependencies: - dependency-name: alpine dependency-version: '3.24' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: images - dependency-name: debian dependency-version: bookworm-slim dependency-type: direct:production dependency-group: images - dependency-name: node dependency-version: 26-bookworm-slim dependency-type: direct:production dependency-group: images - dependency-name: oven/bun dependency-version: 1.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: images ... Signed-off-by: dependabot[bot] --- Dockerfile | 10 +++++----- web/Dockerfile | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/Dockerfile b/Dockerfile index 8134af71..bcc8f6ba 100644 --- a/Dockerfile +++ b/Dockerfile @@ -17,7 +17,7 @@ # deploy/k3s/dev-push.sh loop. Only the five kloudlite binaries make it into the context — see # .dockerignore — so a fat `target/` costs nothing to send. -FROM debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241 AS server +FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171 AS server # openssh-client: the server shells out to ssh-keygen to generate its host key on first start. # git: the merge worker performs merges by running it (see crates/pulls/src/merge_worker.rs) — # bookworm ships 2.39, past the 2.38 that `merge-tree --write-tree` needs. One image serves all @@ -53,7 +53,7 @@ CMD ["serve"] # The node controller. A separate IMAGE, not a fourth binary in the server one: this runs as root # with btrfs-progs and the host pool mounted, and shipping root's toolchain to the three processes # that must never have it is exactly what the split prevents. -FROM debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241 AS agent +FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171 AS agent # btrfs-progs: every storage operation shells out to it. # util-linux: losetup/mount for the block-layer restore path. # ca-certificates: the registry client and Azure blob store speak TLS. @@ -81,7 +81,7 @@ ENTRYPOINT ["kloudlite-agent"] # The SSH gateway. Its own image rather than a fourth binary in the server one: this pod runs with # NET_BIND_SERVICE to hold hostPort 443 on a pool node, and that capability has no business on the # git server's pods. -FROM debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241 AS gateway +FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171 AS gateway # ca-certificates only: the gateway talks to the kube API server over TLS and to nothing else. # libcap2-bin is build-time only, for the setcap below. RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates libcap2-bin \ @@ -117,7 +117,7 @@ ENTRYPOINT ["kloudlite-gateway"] # agent builds per workspace and mounts read-only, so this image stays stock apart from the above. # Runtime steps that depend on mounts (chown of the volume, seeding rc files, exec sshd) live in # `k8s::prelude`, not here. -FROM alpine:3.20 AS workspace +FROM alpine:3.24 AS workspace RUN apk add --no-cache libstdc++ libgcc \ && mkdir -p /var/empty \ && adduser -D -u 1000 -s /nix/profile/current/bin/zsh kl \ @@ -127,7 +127,7 @@ RUN apk add --no-cache libstdc++ libgcc \ # The SLO probe. Its own image because it is the only one that carries a toolbox — git, ssh, # crane, kubectl, dig, openssl — and shipping that to the three server processes would hand a # compromised request handler everything it needs to talk to the cluster. -FROM debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241 AS slo +FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171 AS slo # git + openssh-client: stage 2 pushes and clones over both transports, with a real client, because # a probe that used our own library would pass on a bug only a real client trips. # curl is the build-time tool fetch below; the edge stage dials the origin with reqwest. diff --git a/web/Dockerfile b/web/Dockerfile index 4159a0ec..ec445e6e 100644 --- a/web/Dockerfile +++ b/web/Dockerfile @@ -4,13 +4,13 @@ # package is visible. # 1.3.14 exactly, matching CI's setup-bun, so the lockfile is read by one bun everywhere. -FROM oven/bun:1.3.14@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4 AS bun +FROM oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895 AS bun # Node, with bun copied in. bun installs (it owns the lockfile) but does not run # the build: `next build` under bun's runtime dies with SIGILL on GitHub's # runners, while the same build under node is fine — which is what CI's check # job does too. -FROM node:22-bookworm-slim@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436 AS deps +FROM node:26-bookworm-slim@sha256:367679cf9792759492a486e4aa4b421764d71a9546a6dae8aab81a99eb797b3e AS deps COPY --from=bun /usr/local/bin/bun /usr/local/bin/bun WORKDIR /src # The whole workspace at once, not a hand-listed set of manifests: that would @@ -28,7 +28,7 @@ RUN node node_modules/next/dist/bin/next build apps/web # Same libc as the build stage: the standalone output carries native modules # (sharp, shiki's oniguruma) compiled against it. -FROM node:22-bookworm-slim@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436 AS run +FROM node:26-bookworm-slim@sha256:367679cf9792759492a486e4aa4b421764d71a9546a6dae8aab81a99eb797b3e AS run WORKDIR /app ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT=3000 HOSTNAME=0.0.0.0 RUN useradd --system --create-home --uid 1001 app