Skip to content

build(docker): switch runtime images from debian to wolfi-base #1020

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
feliperalmeida wants to merge 1 commit into
base: main
Choose a base branch
from
+20 −29
Open

build(docker): switch runtime images from debian to wolfi-base #1020

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -840,7 +840,7 @@ entrypoint), `controlplane/reshard_pod.go` (spawner) +
kept on success. The objects carry NO object tag: PutObject with x-amz-tagging
needs `s3:PutObjectTagging`, which the org duckling roles do not grant (a
tagged upload 403s on the real cluster — mw-dev e2e regression). pg_dump/pg_restore ship in the CP image
(`postgresql-client-18`, PGDG repo, in BOTH `Dockerfile` and
(Wolfi's `postgresql-18-client` apk, in BOTH `Dockerfile` and
`Dockerfile.controlplane`). Full design + restore procedure:
`docs/design/resharding.md`.
- **Source identity: the duckling STATUS is authoritative, validated at
Expand Down
21 changes: 8 additions & 13 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,22 +71,17 @@ RUN CGO_ENABLED=1 \
./duckdbservice
RUN CGO_ENABLED=1 go build -tags "${BUILD_TAGS}" -ldflags "-X main.version=${VERSION} -X main.commit=${COMMIT} -X main.date=$(date -u +%Y-%m-%dT%H:%M:%SZ)" -o duckgres .

FROM debian:bookworm-slim
FROM chainguard/wolfi-base:latest

# postgresql-client-18 provides pg_dump/pg_restore, used by the control-plane
# postgresql-18-client provides pg_dump/pg_restore, used by the control-plane
# reshard runner's pre-flip catalog backup (docs/design/resharding.md). Pinned
# to PG 18 to match the cnpg shard major so it can dump PG-18 catalogs. From the
# PGDG apt repo because Debian bookworm's stock repo only carries PG 15. mw-dev
# to PG 18 to match the cnpg shard major so it can dump PG-18 catalogs. mw-dev
# runs this single all-in-one image as BOTH control plane and workers, so the
# client must live here (not only in Dockerfile.controlplane).
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates gnupg wget \
&& install -d /usr/share/postgresql-common/pgdg \
&& wget -qO /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc https://www.postgresql.org/media/keys/ACCC4CF8.asc \
&& echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
&& apt-get update && apt-get install -y --no-install-recommends postgresql-client-18 \
&& apt-get purge -y gnupg wget && apt-get autoremove -y \
&& rm -rf /var/lib/apt/lists/*
RUN groupadd -r duckgres && useradd -r -g duckgres -d /app duckgres
# client must live here (not only in Dockerfile.controlplane). libstdc++ is
# the C++ runtime the CGO-linked DuckDB engine needs — present implicitly on
# debian-slim, but not in wolfi-base.
RUN apk add --no-cache ca-certificates-bundle libstdc++ postgresql-18-client \
&& addgroup -S duckgres && adduser -S -G duckgres -h /app duckgres

WORKDIR /app
COPY --from=builder /build/duckgres .
Expand Down
18 changes: 6 additions & 12 deletions Dockerfile.controlplane
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,20 +43,14 @@ RUN CGO_ENABLED=1 go build -tags "${BUILD_TAGS}" \
-o duckgres-controlplane \
./cmd/duckgres-controlplane

FROM debian:bookworm-slim
FROM chainguard/wolfi-base:latest

@Piccirello Piccirello Jul 31, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any risk in moving from a specific version of debian to unpinned wolfi version?

@feliperalmeida feliperalmeida Jul 31, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought about that for a bit, and ended up concluding that wolfi-base is such a small image (basically OS + glibc + apk + bash) that seemed ok to use latest - they provide sha tags for reproducible builds if that's something we'd look for, but I don't think that should be needed.


# postgresql-client-18 provides pg_dump/pg_restore for the reshard runner's
# postgresql-18-client provides pg_dump/pg_restore for the reshard runner's
# pre-flip catalog backup (docs/design/resharding.md). Pinned to PG 18 to match
# the cnpg shard major so it can dump PG-18 catalogs. From the PGDG apt repo
# because Debian bookworm's stock repo only carries PG 15.
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates gnupg wget \
&& install -d /usr/share/postgresql-common/pgdg \
&& wget -qO /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc https://www.postgresql.org/media/keys/ACCC4CF8.asc \
&& echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" > /etc/apt/sources.list.d/pgdg.list \
&& apt-get update && apt-get install -y --no-install-recommends postgresql-client-18 \
&& apt-get purge -y gnupg wget && apt-get autoremove -y \
&& rm -rf /var/lib/apt/lists/*
RUN groupadd -r duckgres && useradd -r -g duckgres -d /app duckgres
# the cnpg shard major so it can dump PG-18 catalogs. No libstdc++ here: this
# image does not link libduckdb (pg_query_go's libpg_query is plain C).
RUN apk add --no-cache ca-certificates-bundle postgresql-18-client \
&& addgroup -S duckgres && adduser -S -G duckgres -h /app duckgres

WORKDIR /app
COPY --from=builder /build/duckgres-controlplane .
Expand Down
8 changes: 5 additions & 3 deletions Dockerfile.worker
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,10 +155,12 @@ RUN if [ -n "$DUCKDB_BINDINGS_VERSION" ]; then \
echo "Verified: duckgres-worker linked against duckdb-go-bindings@$embedded" ; \
fi

FROM debian:bookworm-slim
FROM chainguard/wolfi-base:latest

RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
RUN groupadd -r duckgres && useradd -r -g duckgres -d /app duckgres
# libstdc++ is the C++ runtime the CGO-linked DuckDB engine needs — present
# implicitly on debian-slim, but not in wolfi-base.
RUN apk add --no-cache ca-certificates-bundle libstdc++ \
&& addgroup -S duckgres && adduser -S -G duckgres -h /app duckgres

WORKDIR /app
COPY --from=builder /build/duckgres-worker .
Expand Down
Loading