Skip to content

upgrade base image to debian 13 #1557

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
huww98 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

upgrade base image to debian 13 #1557

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions build/gather-node-deps.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,10 @@ mkdir -p /staging-node/var/lib/dpkg/status.d

DEPS=(
/etc/netconfig
/etc/mke2fs.conf /sbin/{fsck,mkfs,mount,umount}.{ext{2,3,4},xfs,nfs}
/etc/mke2fs.conf /usr/sbin/{fsck,mkfs,mount,umount}.{ext{2,3,4},xfs,nfs}

@mowangdk mowangdk May 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch updating paths from /sbin/ to /usr/sbin/ for Debian 13 (which no longer uses the /sbin symlink split). Verify that /usr/sbin/mount.nfs and /usr/sbin/umount.nfs actually exist in trixie — historically NFS mount helpers may be in different locations depending on the nfs-common package version.

/usr/bin/{mount,umount,chmod,grep,tail,partx}
/usr/sbin/{fsck,mkfs,sfdisk,losetup}
/sbin/resize2fs
/usr/sbin/resize2fs
/usr/sbin/xfs_growfs
)

Expand Down
14 changes: 9 additions & 5 deletions build/multi/Dockerfile.multi
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ RUN --mount=type=bind,target=. \
-o /out/plugin.csi.alibabacloud.com && \
go build -trimpath -o /out/csiplugin-connector ./build/lib/csiplugin-connector.go

FROM registry-cn-hangzhou.ack.aliyuncs.com/dev/ack-base/distroless/base-debian12:latest@sha256:347a41e7f263ea7f7aba1735e5e5b1439d9e41a9f09179229f8c13ea98ae94cf as distroless-base
FROM registry-cn-hangzhou.ack.aliyuncs.com/dev/ack-base/distroless/base-debian13:latest@sha256:8c8b7cf2a01e2d1c683128b2488d77139fa90ec8cb807f0ae260d57f7022dedd as distroless-base
LABEL maintainers="Alibaba Cloud Authors" description="Alibaba Cloud CSI Plugin"
ARG OSSFS_IMAGE_TAG=v1.91.9.ack.1-b81059f
ARG OSSFS2_IMAGE_TAG=v2.0.5.ack.1-663afcf
Expand All @@ -25,7 +25,7 @@ FROM distroless-base as csi-base
COPY --link --from=build /out/plugin.csi.alibabacloud.com /usr/bin/plugin.csi.alibabacloud.com
ENTRYPOINT ["/usr/bin/plugin.csi.alibabacloud.com"]

FROM registry-cn-hangzhou.ack.aliyuncs.com/dev/debian:bookworm-20260112-slim as debian
FROM registry-cn-hangzhou.ack.aliyuncs.com/dev/debian:trixie-20260202-slim as debian

ARG TARGETARCH
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=apt-cache-$TARGETARCH \
Expand All @@ -44,15 +44,18 @@ RUN --mount=type=bind,from=distroless-base,target=/base \
FROM distroless-base as dep-list
COPY --link --from=debian /staging-node /

FROM --platform=$BUILDPLATFORM registry-cn-hangzhou.ack.aliyuncs.com/dev/debian:bookworm-20260112-slim as build-0
FROM --platform=$BUILDPLATFORM registry-cn-hangzhou.ack.aliyuncs.com/dev/debian:trixie-20260202-slim as build-0
ARG BUILDARCH
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=apt-cache-$BUILDARCH \
--mount=type=cache,target=/var/lib/apt,sharing=locked,id=apt-lib-$BUILDARCH \
rm -f /etc/apt/apt.conf.d/docker-clean && \
echo 'Acquire::Check-Valid-Until false;' > /etc/apt/apt.conf.d/snapshot && \
sed -i '/^URIs:/d; s|^# \(http://snapshot.debian.org/\)|URIs: \1|' /etc/apt/sources.list.d/debian.sources && \
apt-get update && \
apt-get install -y tar xz-utils make diffutils
apt-get install -y tar xz-utils make diffutils gcc
# We need to install gcc in addition to gcc-${HOST} below.
# On e.g. amd64, gcc-x86-64-linux-gnu depends on "binutils-x86-64-linux-gnu", but it calls `as`, which is in "binutils" and not installed by default.
# See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1083135

FROM build-0 as build-util-linux-amd64
ENV HOST=x86_64-linux-gnu
Expand All @@ -79,7 +82,8 @@ SOURCE_DATE_EPOCH=$(stat -c %Y /src.tar.xz)
export SOURCE_DATE_EPOCH
echo "util-linux released at $(date --date "@$SOURCE_DATE_EPOCH" --iso-8601=seconds)"
./configure --disable-all-programs --enable-blkid --enable-libblkid --libdir=\${prefix}/lib/$HOST \
--disable-nls --disable-bash-completion --disable-asciidoc --disable-dependency-tracking --disable-static --host=$HOST
--disable-nls --disable-bash-completion --disable-asciidoc --disable-dependency-tracking --disable-static --host=$HOST || \
{ RET=$?; echo "content of ./config.log:"; cat ./config.log; exit $RET; }
make -j
make install-strip DESTDIR=/install
mkdir -p /out
Expand Down
70 changes: 36 additions & 34 deletions hack/base-image-deps.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,34 +1,36 @@
base-files 12.4+deb12u13
coreutils 9.1-1
e2fsprogs 1.47.0-2+b2
fdisk 2.38.1-5+deb12u3
grep 3.8-5
libblkid1 2.38.1-5+deb12u3
libc6 2.36-9+deb12u13
libcom-err2 1.47.0-2+b2
libext2fs2 1.47.0-2+b2
libfdisk1 2.38.1-5+deb12u3
libgssapi-krb5-2 1.20.1-2+deb12u4
libinih1 55-1
libk5crypto3 1.20.1-2+deb12u4
libkeyutils1 1.6.3-2
libkrb5-3 1.20.1-2+deb12u4
libkrb5support0 1.20.1-2+deb12u4
libmount1 2.38.1-5+deb12u3
libpcre2-8-0 10.42-1
libreadline8 8.2-1.3
libselinux1 3.4-1+b6
libsmartcols1 2.38.1-5+deb12u3
libssl3 3.0.18-1~deb12u2
libtinfo6 6.4-4
libtirpc-common 1.3.3+ds-1
libtirpc3 1.3.3+ds-1
liburcu8 0.13.2-1
libuuid1 2.38.1-5+deb12u3
media-types 10.0.0
mount 2.38.1-5+deb12u3
netbase 6.4
nfs-common 1:2.6.2-4+deb12u1
tzdata 2025b-0+deb12u2
util-linux 2.38.1-5+deb12u3
xfsprogs 6.1.0-1
base-files 13.8+deb13u3
coreutils 9.7-3
e2fsprogs 1.47.2-3+b7
fdisk 2.41-5
grep 3.11-4
libblkid1 2.41-5
libc6 2.41-12+deb13u1
libcom-err2 1.47.2-3+b7
libext2fs2t64 1.47.2-3+b7
libfdisk1 2.41-5
libgssapi-krb5-2 1.21.3-5
libinih1 59-1
libk5crypto3 1.21.3-5
libkeyutils1 1.6.3-6
libkrb5-3 1.21.3-5
libkrb5support0 1.21.3-5
libmount1 2.41-5
libpcre2-8-0 10.46-1~deb13u1
libreadline8t64 8.2-6
libselinux1 3.8.1-1
libsmartcols1 2.41-5
libssl3t64 3.5.4-1~deb13u2
libtinfo6 6.5+20250216-2
libtirpc-common 1.3.6+ds-1
libtirpc3t64 1.3.6+ds-1
liburcu8t64 0.15.2-2
libuuid1 2.41-5
libzstd1 1.5.7+dfsg-1
media-types 13.0.0
mount 2.41-5
netbase 6.5
nfs-common 1:2.8.3-1
tzdata 2025b-4+deb13u1
util-linux 2.41-5
xfsprogs 6.13.0-2+b1
zlib1g 1:1.3.dfsg+really1.3.1-1+b1
6 changes: 3 additions & 3 deletions hack/update-dockerfile.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,18 +8,18 @@ skopeo() {

DOCKERFILE=build/multi/Dockerfile.multi

DISTROLESS=registry-cn-hangzhou.ack.aliyuncs.com/dev/ack-base/distroless/base-debian12
DISTROLESS=registry-cn-hangzhou.ack.aliyuncs.com/dev/ack-base/distroless/base-debian13
DEBIAN=registry-cn-hangzhou.ack.aliyuncs.com/dev/debian

if [ "$UPSTREAM" ]; then
DISTROLESS=gcr.io/distroless/base-debian12
DISTROLESS=gcr.io/distroless/base-debian13
DEBIAN=docker.io/debian
fi

DISTROLESS_DIGEST=$(skopeo inspect docker://$DISTROLESS --format '{{.Digest}}')
echo "The latest distroless digest is $DISTROLESS_DIGEST"

DEBIAN_TAG=$(skopeo list-tags docker://$DEBIAN | jq -r '.Tags|map(select(test("^bookworm-.+-slim$"))) | sort | last')
DEBIAN_TAG=$(skopeo list-tags docker://$DEBIAN | jq -r '.Tags|map(select(test("^trixie-.+-slim$"))) | sort | last')
echo "The latest debian tag is $DEBIAN_TAG"

sed -i "
Expand Down
1 change: 1 addition & 0 deletions pkg/utils/util.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -648,6 +648,7 @@ func mkfsDefaultArgs(fstype, source string) (args []string) {
} else if fstype == "xfs" {
args = []string{
"-f",
"-i", "nrext64=0", // This requires kernel v5.19, so disable for now.

@huww98 huww98 Nov 14, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

another reason to hold this. We will need to replace ASI dockerfile before merge. Old mkfs.xfs will not understand this flag.

@mowangdk mowangdk May 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment says nrext64=0 requires kernel v5.19 so it's disabled — but the flag is being explicitly set to 0, which disables the feature. The comment is correct but slightly confusing. Consider rewording to: nrext64=0: disable large extent counters for compatibility with kernels < v5.19.

source,
}
}
Expand Down