Repository navigation
Move the almanack image off end-of-life Debian bullseye - #69
Merged
Merged
Conversation
The bullseye security pool stopped carrying the package versions that its own package index still references, so apt-get install failed with 404s on perl-base, git-man and libexpat1 and the image could not be built at all. The build workflow only triggers on changes to the Dockerfile or to itself, so this went unnoticed for months. Verified by building the image and running almanack end to end inside it: python 3.13.15, almanack 0.1.17, 100 metrics, score 0.727.
d33bs
approved these changes
Sep 15, 2026
d33bs
left a comment
d33bs
left a comment
Collaborator
There was a problem hiding this comment.
Nice catch! Optionally, consider setting up Dependabot to check for these kinds of things - I think this might have been triggered prior to running into it (https://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories#docker).
The base-image rationale belongs in the pull request description, not in the file, and the surviving comment no longer names specific Python versions so it does not go stale the next time either version moves.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was broken
docker/almanack/Dockerfilecould not be built.apt-get installreturned 404s forperl-base,git-manandlibexpat1: Debian bullseye reached end of life, and its security pool stopped carrying the package versions that its own package index still references.This is not a regression from anything recent. I built the current
mainDockerfile locally and got the identical failure, so Dependabot PR #67 (which bumps the same base image) did not cause it and does not fix it either.It went unnoticed because
.github/workflows/docker_almanack.ymlonly triggers on changes to the Dockerfile or to itself. Nothing rebuilds the image on a schedule, so base-image decay is invisible until someone touches the file.The change
python:3.11-slim-bullseyetopython:3.13-slim-trixie.Both
3.13-slim-bookwormand3.13-slim-trixiebuild clean. Trixie has the longer support window, so picking it buys more time before this recurs. Only Almanack runs in this image, so the Python version answers to Almanack alone and is independent of the 3.11 the pipeline's other processes use.Verification
Built the image, then ran Almanack end to end inside it against a checkout of this repo:
repo-almanack-score0.727 (8 of 11)Follow-ups, not in this PR
almanackunpinned, so which version produced a given cohort's data depends on when the image happened to be built. Worth pinning for the manuscript's reproducibility story.schedule:trigger todocker_almanack.ymlwould catch the next round of base-image rot rather than waiting for someone to edit the Dockerfile.Closes #67 as superseded.
Why Dependabot did not prevent this
The
dockerecosystem is already configured in.github/dependabot.ymlagainst/docker/almanack, and #67 is its output. It cannot catch this class of problem: Dependabot treats the distro suffix in the tag as a variant to preserve, so it proposed3.11-slim-bullseyeto3.13-slim-bullseye, moving the Python version while keeping the end-of-life distro. That PR'sbuildcheck fails for the same 404s asmain. Nothing short of a scheduled rebuild will surface base-image decay here.