From 2532ec52ee46ebb9526509bce71d7e4755c7e283 Mon Sep 17 00:00:00 2001 From: k0d3r1s Date: Sat, 8 Aug 2026 21:11:29 +0300 Subject: [PATCH 1/2] Reconcile final-stage apt state before perl-dependent postinsts run The final stages of the php images never upgrade the base packages, so when the builder stage rebuilds fresh (new PHP source invalidates its cache) while curl:latest's apt layers are cache hits, the wholesale COPY --from=builder /usr/bin/ overwrites /usr/bin/perl with a newer interpreter than the base image's XS modules. Debian sid's perl 5.40->5.42 transition turned that skew into dpkg postinst failures (Perl API version v5.40.0 of Cwd does not match v5.42.0) in the build php-zts-base-master step. Add apt-get dist-upgrade -y to the five final stages that lack an upgrade (zts-base, base, testing, zts-testing, franken-testing); fpm, zts, and franken already have one. dist-upgrade rather than upgrade because a mid-transition perl-base upgrade can require new packages, which plain upgrade silently holds back. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_015tYeFcz7Z3Faz4hVMvvayk --- php/base/Dockerfile | 1 + php/franken-testing/Dockerfile | 1 + php/testing/Dockerfile | 1 + php/zts-base/Dockerfile | 1 + php/zts-testing/Dockerfile | 1 + 5 files changed, 5 insertions(+) diff --git a/php/base/Dockerfile b/php/base/Dockerfile index 1fa3bdd..da5b9cb 100644 --- a/php/base/Dockerfile +++ b/php/base/Dockerfile @@ -200,6 +200,7 @@ COPY --from=builder /var/lib/php/ /var/lib/php/ RUN \ set -eux \ && apt-get update \ +&& apt-get dist-upgrade -y \ && apt-get install -y --no-install-recommends --allow-downgrades \ libxml2 libssl3t64 libsqlite3-0 libbz2-1.0 libidn2-0 \ zstd libbrotli1 libpsl5t64 libgsasl18 rtmpdump librtmp1 libnghttp3-9 nghttp2 \ diff --git a/php/franken-testing/Dockerfile b/php/franken-testing/Dockerfile index 204ea92..af03c77 100644 --- a/php/franken-testing/Dockerfile +++ b/php/franken-testing/Dockerfile @@ -123,6 +123,7 @@ COPY php/ini/opcache.no-jit.ini /usr/local/etc/php/conf.d/docker-php-ext-opca RUN \ set -eux \ && apt-get update \ +&& apt-get dist-upgrade -y \ && apt-get install -y --no-install-recommends --allow-downgrades \ libcap2-bin libstdc++6 \ && apt-get autoremove -y --purge \ diff --git a/php/testing/Dockerfile b/php/testing/Dockerfile index aa8b6c2..1c79c5b 100644 --- a/php/testing/Dockerfile +++ b/php/testing/Dockerfile @@ -112,6 +112,7 @@ COPY --from=composer:2 /usr/bin/composer /usr/bin/ RUN \ set -eux \ && apt-get update \ +&& apt-get dist-upgrade -y \ && apt-get autoremove -y --purge \ && rm -rf /var/cache/apt/* /var/lib/apt/lists/* /var/log/* /tmp/* /var/tmp/* \ && ldconfig \ diff --git a/php/zts-base/Dockerfile b/php/zts-base/Dockerfile index da0c691..dcee6f3 100644 --- a/php/zts-base/Dockerfile +++ b/php/zts-base/Dockerfile @@ -188,6 +188,7 @@ COPY --from=builder /var/lib/php/ /var/lib/php/ RUN \ set -eux \ && apt-get update \ +&& apt-get dist-upgrade -y \ && apt-get install -y --no-install-recommends --allow-downgrades \ libxml2 libssl3t64 libsqlite3-0 libbz2-1.0 libidn2-0 \ zstd libbrotli1 libpsl5t64 libgsasl18 rtmpdump librtmp1 libnghttp3-9 nghttp2 \ diff --git a/php/zts-testing/Dockerfile b/php/zts-testing/Dockerfile index cb27db7..0447b1f 100644 --- a/php/zts-testing/Dockerfile +++ b/php/zts-testing/Dockerfile @@ -110,6 +110,7 @@ COPY --from=composer:2 /usr/bin/composer /usr/bin/ RUN \ set -eux \ && apt-get update \ +&& apt-get dist-upgrade -y \ && apt-get autoremove -y --purge \ && rm -rf /var/cache/apt/* /var/lib/apt/lists/* /var/log/* /tmp/* /var/tmp/* \ && ldconfig \ From 2530a65c5348d28473798c110d35e393ce6a9968 Mon Sep 17 00:00:00 2001 From: k0d3r1s Date: Sat, 8 Aug 2026 21:24:27 +0300 Subject: [PATCH 2/2] Apply review findings to the dist-upgrade change Add --no-install-recommends to the dist-upgrade lines so replacement packages pulled mid-transition do not drag in Recommends, and a comment explaining why dist-upgrade is used instead of upgrade, so a future harmonizing pass does not revert it. Convert the fpm, zts, and franken final stages from upgrade to the same dist-upgrade line: they share the wholesale /usr/bin copy pattern, and plain upgrade silently holds back perl-base when the transition needs package adds or removals. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_015tYeFcz7Z3Faz4hVMvvayk --- php/base/Dockerfile | 3 ++- php/fpm/Dockerfile | 3 ++- php/franken-testing/Dockerfile | 3 ++- php/franken/Dockerfile | 3 ++- php/testing/Dockerfile | 3 ++- php/zts-base/Dockerfile | 3 ++- php/zts-testing/Dockerfile | 3 ++- php/zts/Dockerfile | 3 ++- 8 files changed, 16 insertions(+), 8 deletions(-) diff --git a/php/base/Dockerfile b/php/base/Dockerfile index da5b9cb..c247b93 100644 --- a/php/base/Dockerfile +++ b/php/base/Dockerfile @@ -200,7 +200,8 @@ COPY --from=builder /var/lib/php/ /var/lib/php/ RUN \ set -eux \ && apt-get update \ -&& apt-get dist-upgrade -y \ +# dist-upgrade, not upgrade: sid transitions can need package adds/removals to move perl-base; plain upgrade holds it back and perl postinsts break on the skew +&& apt-get dist-upgrade -y --no-install-recommends \ && apt-get install -y --no-install-recommends --allow-downgrades \ libxml2 libssl3t64 libsqlite3-0 libbz2-1.0 libidn2-0 \ zstd libbrotli1 libpsl5t64 libgsasl18 rtmpdump librtmp1 libnghttp3-9 nghttp2 \ diff --git a/php/fpm/Dockerfile b/php/fpm/Dockerfile index b127439..1695e2e 100644 --- a/php/fpm/Dockerfile +++ b/php/fpm/Dockerfile @@ -147,7 +147,8 @@ COPY --from=builder /var/lib/php/ /var/lib/php/ RUN \ set -eux \ && apt-get update \ -&& apt-get upgrade -y \ +# dist-upgrade, not upgrade: sid transitions can need package adds/removals to move perl-base; plain upgrade holds it back and perl postinsts break on the skew +&& apt-get dist-upgrade -y --no-install-recommends \ && apt-get install -y --no-install-recommends --allow-downgrades \ libpng16-16t64 libjpeg62-turbo libbrotli1 libwebp7 libfreetype6 \ libevent-2.1-7t64 libevent-core-2.1-7t64 libevent-extra-2.1-7t64 libevent-openssl-2.1-7t64 libevent-pthreads-2.1-7t64 \ diff --git a/php/franken-testing/Dockerfile b/php/franken-testing/Dockerfile index af03c77..a0a06b7 100644 --- a/php/franken-testing/Dockerfile +++ b/php/franken-testing/Dockerfile @@ -123,7 +123,8 @@ COPY php/ini/opcache.no-jit.ini /usr/local/etc/php/conf.d/docker-php-ext-opca RUN \ set -eux \ && apt-get update \ -&& apt-get dist-upgrade -y \ +# dist-upgrade, not upgrade: sid transitions can need package adds/removals to move perl-base; plain upgrade holds it back and perl postinsts break on the skew +&& apt-get dist-upgrade -y --no-install-recommends \ && apt-get install -y --no-install-recommends --allow-downgrades \ libcap2-bin libstdc++6 \ && apt-get autoremove -y --purge \ diff --git a/php/franken/Dockerfile b/php/franken/Dockerfile index 19d0cbd..c21fe67 100644 --- a/php/franken/Dockerfile +++ b/php/franken/Dockerfile @@ -123,7 +123,8 @@ COPY php/ini/opcache.ini /usr/local/etc/php/conf.d/docker-php-ext-opcache.ini RUN \ set -eux \ && apt-get update \ -&& apt-get upgrade -y \ +# dist-upgrade, not upgrade: sid transitions can need package adds/removals to move perl-base; plain upgrade holds it back and perl postinsts break on the skew +&& apt-get dist-upgrade -y --no-install-recommends \ && apt-get install -y --no-install-recommends --allow-downgrades \ libcap2-bin libstdc++6 \ && apt-get autoremove -y --purge \ diff --git a/php/testing/Dockerfile b/php/testing/Dockerfile index 1c79c5b..90df775 100644 --- a/php/testing/Dockerfile +++ b/php/testing/Dockerfile @@ -112,7 +112,8 @@ COPY --from=composer:2 /usr/bin/composer /usr/bin/ RUN \ set -eux \ && apt-get update \ -&& apt-get dist-upgrade -y \ +# dist-upgrade, not upgrade: sid transitions can need package adds/removals to move perl-base; plain upgrade holds it back and perl postinsts break on the skew +&& apt-get dist-upgrade -y --no-install-recommends \ && apt-get autoremove -y --purge \ && rm -rf /var/cache/apt/* /var/lib/apt/lists/* /var/log/* /tmp/* /var/tmp/* \ && ldconfig \ diff --git a/php/zts-base/Dockerfile b/php/zts-base/Dockerfile index dcee6f3..a7debb5 100644 --- a/php/zts-base/Dockerfile +++ b/php/zts-base/Dockerfile @@ -188,7 +188,8 @@ COPY --from=builder /var/lib/php/ /var/lib/php/ RUN \ set -eux \ && apt-get update \ -&& apt-get dist-upgrade -y \ +# dist-upgrade, not upgrade: sid transitions can need package adds/removals to move perl-base; plain upgrade holds it back and perl postinsts break on the skew +&& apt-get dist-upgrade -y --no-install-recommends \ && apt-get install -y --no-install-recommends --allow-downgrades \ libxml2 libssl3t64 libsqlite3-0 libbz2-1.0 libidn2-0 \ zstd libbrotli1 libpsl5t64 libgsasl18 rtmpdump librtmp1 libnghttp3-9 nghttp2 \ diff --git a/php/zts-testing/Dockerfile b/php/zts-testing/Dockerfile index 0447b1f..e01b1ef 100644 --- a/php/zts-testing/Dockerfile +++ b/php/zts-testing/Dockerfile @@ -110,7 +110,8 @@ COPY --from=composer:2 /usr/bin/composer /usr/bin/ RUN \ set -eux \ && apt-get update \ -&& apt-get dist-upgrade -y \ +# dist-upgrade, not upgrade: sid transitions can need package adds/removals to move perl-base; plain upgrade holds it back and perl postinsts break on the skew +&& apt-get dist-upgrade -y --no-install-recommends \ && apt-get autoremove -y --purge \ && rm -rf /var/cache/apt/* /var/lib/apt/lists/* /var/log/* /tmp/* /var/tmp/* \ && ldconfig \ diff --git a/php/zts/Dockerfile b/php/zts/Dockerfile index 0a4e740..44526c8 100644 --- a/php/zts/Dockerfile +++ b/php/zts/Dockerfile @@ -145,7 +145,8 @@ COPY --from=builder /var/lib/php/ /var/lib/php/ RUN \ set -eux \ && apt-get update \ -&& apt-get upgrade -y \ +# dist-upgrade, not upgrade: sid transitions can need package adds/removals to move perl-base; plain upgrade holds it back and perl postinsts break on the skew +&& apt-get dist-upgrade -y --no-install-recommends \ && apt-get install -y --no-install-recommends --allow-downgrades \ libpng16-16t64 libjpeg62-turbo libbrotli1 libwebp7 libfreetype6 \ libevent-2.1-7t64 libevent-core-2.1-7t64 libevent-extra-2.1-7t64 libevent-openssl-2.1-7t64 libevent-pthreads-2.1-7t64 \