From 98f9c6e1ea7ff1fce73b4417d5c3107f94ae4c1a Mon Sep 17 00:00:00 2001 From: Jarle Hjortland Date: Tue, 25 Feb 2025 16:06:26 +0100 Subject: [PATCH 1/7] Use pg_repack 1.5.2 and dotnetruntime --- 17/Dockerfile | 4 ++-- build.sh | 8 ++------ 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/17/Dockerfile b/17/Dockerfile index 1b4f38b..343c70a 100644 --- a/17/Dockerfile +++ b/17/Dockerfile @@ -1,9 +1,9 @@ -FROM alpine:3.20 +FROM mcr.microsoft.com/dotnet/runtime:9.0-alpine3.20 ENV PG_MAJOR 17 ENV PG_VERSION 17.0 ENV PG_SHA256 7e276131c0fdd6b62588dbad9b3bb24b8c3498d5009328dba59af16e819109de -ENV PG_REPACK_VERSION 1.5.1 +ENV PG_REPACK_VERSION 1.5.2 ENV LANG en_US.utf8 WORKDIR /pg_repack diff --git a/build.sh b/build.sh index 0c78e59..0bf2bbd 100755 --- a/build.sh +++ b/build.sh @@ -1,12 +1,8 @@ #!/bin/bash PG_REPACK=( - "12,1.4.5" - "13,1.4.6" - "14,1.4.7" - "15,1.4.8" - "16,1.5.0" - "17,1.5.1" + + "17,1.5.2" ) # Check command exist function From 35bdd853e55b5888376f7183714e5eb8a1eb8f7e Mon Sep 17 00:00:00 2001 From: Cato Lommerud Date: Mon, 11 May 2026 14:31:19 +0200 Subject: [PATCH 2/7] Update to .Net 10 --- 17/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/17/Dockerfile b/17/Dockerfile index 343c70a..aaa89ba 100644 --- a/17/Dockerfile +++ b/17/Dockerfile @@ -1,4 +1,4 @@ -FROM mcr.microsoft.com/dotnet/runtime:9.0-alpine3.20 +FROM mcr.microsoft.com/dotnet/runtime:10.0-alpine3.20 ENV PG_MAJOR 17 ENV PG_VERSION 17.0 From 7c6cbe9b62419db43a2859ea33c42ee4becf9cc5 Mon Sep 17 00:00:00 2001 From: Cato Lommerud Date: Tue, 12 May 2026 09:41:51 +0200 Subject: [PATCH 3/7] wm-16100 Update versjon to 1.5.3 --- 17/Dockerfile | 2 +- build.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/17/Dockerfile b/17/Dockerfile index aaa89ba..d9bbb29 100644 --- a/17/Dockerfile +++ b/17/Dockerfile @@ -3,7 +3,7 @@ FROM mcr.microsoft.com/dotnet/runtime:10.0-alpine3.20 ENV PG_MAJOR 17 ENV PG_VERSION 17.0 ENV PG_SHA256 7e276131c0fdd6b62588dbad9b3bb24b8c3498d5009328dba59af16e819109de -ENV PG_REPACK_VERSION 1.5.2 +ENV PG_REPACK_VERSION 1.5.3 ENV LANG en_US.utf8 WORKDIR /pg_repack diff --git a/build.sh b/build.sh index 0bf2bbd..2df302b 100755 --- a/build.sh +++ b/build.sh @@ -2,7 +2,7 @@ PG_REPACK=( - "17,1.5.2" + "17,1.5.3" ) # Check command exist function From 41f9518e94f3fd7cf2f8bddfed4531e2ef0fb8c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=98ystein=20Monsrud=20Arneson?= Date: Fri, 19 Jun 2026 23:12:01 +0200 Subject: [PATCH 4/7] WM-16100 use aspnet:10.0-alpine3.22 base, drop server-side LLVM/JIT The .NET 10 bump on this branch used dotnet/runtime:10.0-alpine3.20, which has two problems: (1) WALL-E is an ASP.NET app needing Microsoft.AspNetCore.App, which dotnet/runtime lacks (the working 9.x image was aspnet-based), and (2) .NET 10 has no alpine3.20 tag. Switch to dotnet/aspnet:10.0-alpine3.22. Drop --with-llvm and the llvm15-dev/clang15 build deps: PostgreSQL JIT is a server-side feature and irrelevant for this client-side pg_repack image, and Alpine 3.22 no longer ships clang15 (and PG 17.0 won't build against LLVM 20). Removing it also shrinks the image. Verified locally: built image carries Microsoft.AspNetCore.App 10.0.3 + Microsoft.NETCore.App 10.0.3 and pg_repack 1.5.3, and WALL-E starts on it. Co-Authored-By: Claude Opus 4.8 (1M context) --- 17/Dockerfile | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/17/Dockerfile b/17/Dockerfile index d9bbb29..f0ca341 100644 --- a/17/Dockerfile +++ b/17/Dockerfile @@ -1,4 +1,4 @@ -FROM mcr.microsoft.com/dotnet/runtime:10.0-alpine3.20 +FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine3.22 ENV PG_MAJOR 17 ENV PG_VERSION 17.0 @@ -8,10 +8,6 @@ ENV PG_REPACK_VERSION 1.5.3 ENV LANG en_US.utf8 WORKDIR /pg_repack -ENV DOCKER_PG_LLVM_DEPS \ - llvm15-dev \ - clang15 - RUN set -eux; \ \ wget -O postgresql.tar.bz2 "https://ftp.postgresql.org/pub/source/v$PG_VERSION/postgresql-$PG_VERSION.tar.bz2"; \ @@ -26,7 +22,6 @@ RUN set -eux; \ rm postgresql.tar.bz2; \ \ apk add --no-cache --virtual .build-deps \ - $DOCKER_PG_LLVM_DEPS \ bison \ coreutils \ dpkg-dev dpkg \ @@ -63,9 +58,6 @@ RUN set -eux; \ wget -O config/config.guess 'https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=7d3d27baf8107b630586c962c057e22149653deb'; \ wget -O config/config.sub 'https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=7d3d27baf8107b630586c962c057e22149653deb'; \ \ - export LLVM_CONFIG="/usr/lib/llvm15/bin/llvm-config"; \ - export CLANG=clang-15; \ - \ ./configure \ --enable-option-checking=fatal \ --build="$gnuArch" \ @@ -87,7 +79,6 @@ RUN set -eux; \ --with-libxml \ --with-libxslt \ --with-icu \ - --with-llvm \ --with-lz4 \ --with-zstd \ ; \ From 31d4d456d7853d4712e8d13228edc7ee7adceb4b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=98ystein=20Monsrud=20Arneson?= Date: Fri, 19 Jun 2026 23:17:21 +0200 Subject: [PATCH 5/7] WM-16100 document manual harbor publish process for webmed image WebMed's dotnet-pg-repack image is built and pushed to harbor manually from a local machine (upstream CI only pushes to Docker Hub). Document the build/tag/push steps, why the base must be dotnet/aspnet, the no-LLVM rationale, and the tag convention WALL-E depends on. Co-Authored-By: Claude Opus 4.8 (1M context) --- WEBMED.md | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 WEBMED.md diff --git a/WEBMED.md b/WEBMED.md new file mode 100644 index 0000000..7d41c79 --- /dev/null +++ b/WEBMED.md @@ -0,0 +1,40 @@ +# WebMed: publishing `dotnet-pg-repack` to harbor + +This repo is a WebMed fork of [cherts/pg_repack_docker](https://github.com/CHERTS/pg_repack_docker). Upstream CI (`.github/workflows/release.yml`) publishes to Docker Hub (`cherts/pg-repack`). **WebMed does not use that pipeline for its internal image.** + +The image consumed by **WALL-E** (`harbor.k8s.webmed.no:443/webmed/dotnet-pg-repack`) is **built and pushed manually from a local machine** — there is no CI that pushes to harbor. If you change a Dockerfile here, you must rebuild and push by hand or WALL-E will keep running the old image. + +## Why the base is `dotnet/aspnet` (not `dotnet/runtime`) + +WALL-E is an ASP.NET Core service (`Microsoft.NET.Sdk.Web`, health-check endpoint), so its published app needs the **`Microsoft.AspNetCore.App`** shared framework — which only `mcr.microsoft.com/dotnet/aspnet` ships, not `dotnet/runtime`. The `17/Dockerfile` `FROM` must stay on `aspnet`. + +LLVM/JIT is **not** built in (`--with-llvm` removed): JIT is a server-side feature and this is a client-side `pg_repack` image, so it's dead weight (and Alpine 3.22 no longer ships `clang15`). + +## Build & push (PostgreSQL 17 image) + +```bash +# 1. Build (context is the PG-major dir, e.g. 17) +docker build -t dotnet-pg-repack: -f 17/Dockerfile 17 + +# 2. Sanity-check the runtimes and pg_repack +docker run --rm --entrypoint dotnet dotnet-pg-repack: --list-runtimes +docker run --rm --entrypoint pg_repack dotnet-pg-repack: --version + +# 3. Tag for harbor and push +docker login harbor.k8s.webmed.no:443 +docker tag dotnet-pg-repack: harbor.k8s.webmed.no:443/webmed/dotnet-pg-repack: +docker push harbor.k8s.webmed.no:443/webmed/dotnet-pg-repack: +``` + +## Tag convention + +The harbor tag tracks the **pg_repack version** (e.g. `1.5.3`). Historically a `.N` revision suffix was used for rebuilds at the same pg_repack version (e.g. `1.5.2.1`). Keep WALL-E's `Dockerfile` base `FROM` in sync with whatever tag you push. + +| pushed tag | base image | pg_repack | notes | +|------------|-----------|-----------|-------| +| `1.5.2.1` | `dotnet/aspnet:9.0-alpine3.20` | 1.5.2 | previous (.NET 9) | +| `1.5.3` | `dotnet/aspnet:10.0-alpine3.22` | 1.5.3 | .NET 10 (WM-16100) | + +## Consumer + +`WALL-E/Dockerfile` → `FROM harbor.k8s.webmed.no:443/webmed/dotnet-pg-repack:`. From 813709a4af0b153851c5d09582ebcc5da0260d5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=98ystein=20Monsrud=20Arneson?= Date: Fri, 19 Jun 2026 23:21:42 +0200 Subject: [PATCH 6/7] WM-16100 bump to alpine3.23, fix chmod RUN, sync CI pg_repack version Address PR review: use the latest .NET 10 Alpine variant (3.23) for max patches (CVE-driven change); fix the entrypoint chmod RUN where 'set -x \' swallowed the chmod so it never ran (didn't fail the build, but left docker_entrypoint.sh non-executable); and update the postgres-17 CI job's PGREPACK_VERSION 1.5.1 -> 1.5.3 so the cherts/pg-repack tag matches the built contents. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/default.yml | 2 +- 17/Dockerfile | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml index 54bcd12..ab18e1b 100644 --- a/.github/workflows/default.yml +++ b/.github/workflows/default.yml @@ -162,7 +162,7 @@ jobs: steps: - name: Set variables run: | - echo "PGREPACK_VERSION=1.5.1" >> $GITHUB_ENV + echo "PGREPACK_VERSION=1.5.3" >> $GITHUB_ENV echo "PG_VERSION=17" >> $GITHUB_ENV - name: Checkout code uses: actions/checkout@v4 diff --git a/17/Dockerfile b/17/Dockerfile index f0ca341..73db991 100644 --- a/17/Dockerfile +++ b/17/Dockerfile @@ -1,4 +1,4 @@ -FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine3.22 +FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine3.23 ENV PG_MAJOR 17 ENV PG_VERSION 17.0 @@ -120,8 +120,7 @@ RUN set -eux; \ COPY docker_entrypoint.sh /bin -RUN set -x \ - chmod +x /bin/docker_entrypoint.sh +RUN chmod +x /bin/docker_entrypoint.sh ENTRYPOINT ["/bin/docker_entrypoint.sh"] CMD ["-no-superuser-check"] From 5e72cfca21330e60bb7beb1d13bb798d4b176b12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=98ystein=20Monsrud=20Arneson?= Date: Fri, 19 Jun 2026 23:25:34 +0200 Subject: [PATCH 7/7] WM-16100 keep alpine3.22 (3.23 fails to build PostgreSQL 17.0) Reverting the alpine3.23 bump: 3.22 and 3.23 both exist on MCR (the review claim that 3.22 is missing is incorrect), but PostgreSQL 17.0 fails to build from source on 3.23's newer toolchain, while 3.22 builds and is verified. The .NET 10 runtime (where CVE-2026-40372 is fixed) is identical on both, so 3.22 fully covers the CVE. Keeping the chmod and CI-version cleanups. Co-Authored-By: Claude Opus 4.8 (1M context) --- 17/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/17/Dockerfile b/17/Dockerfile index 73db991..f4914db 100644 --- a/17/Dockerfile +++ b/17/Dockerfile @@ -1,4 +1,4 @@ -FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine3.23 +FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine3.22 ENV PG_MAJOR 17 ENV PG_VERSION 17.0