archetech / archon / 31891964958

87%

push

github

deps: Move all images from Debian bullseye to bookworm (#890)

The hyperswarm mediator was moved in #880 after a hotfix: sodium-native 5
raised its prebuilt binding's floor to GLIBC_2.33, which node:*-bullseye
(Debian 11, glibc 2.31) cannot satisfy, and the container exited 1 five
seconds after start. That fix was scoped to the affected image because it
was urgent. Every other image was left on bullseye, so the same class of
break was waiting on the next dependency bump that raises a glibc floor.

It arrives through a routine Dependabot PR and fails at container start
rather than at build time, so CI stays green and only production notices.
The failure is also disguised: require-addon catches the dlopen error and
reports MODULE_NOT_FOUND, pointing at a missing file when the .node is
present and merely unloadable.

Move the remaining 23 node images to node:22.15.0-bookworm-slim (Debian
12, glibc 2.36), and the Rust gatekeeper's two stages together --
rust:1.90-bookworm and debian:bookworm-slim. Together matters: the builder
produces the binary the runtime loads, so a builder newer than its runtime
would reintroduce exactly this failure across the stage boundary.

No apt changes were needed. The packages these images install -- python3,
make, g++, wget, ca-certificates, build-essential -- are all present in
Debian 12, which was the main risk the issue flagged.

Verified by starting the two riskiest images, not merely building them; a
green build is what missed the original outage.

- gatekeeper-rust: glibc 2.36, zero unresolved shared libraries, and the
  binary runs (prints its version banner) before stopping on an absent
  redis. This is the cross-stage case.
- gatekeeper-ts: sqlite3 and @ipshipyard/node-datachannel both load, and
  the container stays running. This is the native-dependency case, the
  same shape as the sodium-native failure.

Node stays at 22.15.0. Debian 13 (trixie) is current stable, but the
official node images only publish trixie... (continued)

3743 of 4212 branches covered (88.87%)

Branch coverage included in aggregate %.

8391 of 8680 relevant lines covered (96.67%)

680.29 hits per line