PENG-1896: Upgrade Docker base image to Debian trixie - #49
Open
william-kurosawa-clio wants to merge 2 commits into
Open
PENG-1896: Upgrade Docker base image to Debian trixie#49william-kurosawa-clio wants to merge 2 commits into
william-kurosawa-clio wants to merge 2 commits into
Conversation
Debian bullseye reaches end of life; move the container base to trixie. The official `ruby` Docker Hub images have no trixie variant for any 3.1.x release (3.1 is EOL and no longer rebuilt), so the smallest possible move is to the newest patch of the next minor line: ruby:3.2.11-trixie. `.ruby-version` and the manual setup doc are updated to match so local and Docker setups stay in sync for external readers of this sample app. Verified by building both the old and new images and running rubocop, a Rails boot check, the test task and an HTTP smoke test of the running server against each, on arm64 and amd64 — behaviour is identical. PENG-1896 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Review caught that 3.2.11-trixie is the wrong landing spot. Ruby 3.2 reached EOL on 2026-03-31, so Docker stopped rebuilding that tag: it was last pushed 2026-04-14 and there is no 3.2.12 to move to. Picking it would have swapped one unpatched base image for another and booked a repeat of this ticket. ruby:3.2.11-trixie last pushed 2026-04-14 (EOL, frozen) ruby:3.3.12-trixie last pushed 2026-08-05 (supported to 2027-03-31) 3.3 rather than 3.4 because Ruby 3.4 moved mutex_m, base64 and bigdecimal from default to bundled gems, and Rails 7.0's ActiveSupport requires mutex_m without declaring it — a hard LoadError under Bundler that Rails 7.0 will never be patched for. Verified on 3.3.12: nokogiri 1.13.10 (Oct 2022, the oldest native extension in the lockfile) compiles, bundle check passes, rubocop reports the same 4 pre-existing offenses, Rails boots 7.0.8.4, and GET / returns 200 with 1972 bytes and the same title as on bullseye. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Emilyho11
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PENG-1896
What
Dockerfile:ruby:3.1.6-bullseye→ruby:3.3.12-trixie..ruby-versionanddocs/manual_setup.mdbumped to3.3.12so the manual (rbenv/asdf) path matches the Docker one.Why
mutex_mto a bundled gem, and Rails 7.0's ActiveSupport requires it without declaring it. HardLoadError, and 7.0 is out of maintenance. Needs a Rails upgrade first.Testing
No CI in this repo (Cycode only), so local verification is the only gate. Built and compared both bases:
nokogiri 1.13.10(oldest native ext in the lockfile, main risk of the two-minor jump) compiles.bundle checksatisfied; Rails 7.0.8.4 boots;GET /returns identical 200 (1972 bytes).rubocop: same 4 pre-existing offenses.OpenSSL 1.1.1 → 3.x: app crypto is
cookies.encrypted(Rails AES-GCM), verifiedJWT.decode, and outbound TLS viahttp— none use legacy-provider algorithms. Node is only an ExecJS runtime foruglifier/coffee-rails.Not verified: OAuth/SSO end-to-end against Identity/Manage (needs real credentials), and
linux/amd64for 3.3.12 specifically (the 3.2.11 round matched on both arches).Notes
Pre-existing, not fixed here:
maineither —test/test_helper.rbcallsfixtures :allwith no ActiveRecord.cache_classesmust befalse). UsedDISABLE_SPRING=1at runtime only; nothing committed.bundler:2.2.21vsBUNDLED WITH 2.4.20(self-corrects at install).scripts/entrypoint.shcleans/myapp/tmp/pids/server.pidbutWORKDIRis/Switchboard— no-op. It also appends to.env, a tracked file, so checkgit statusafterdocker-compose up.🤖 Generated with Claude Code