build: Fix Docker build chain after DHI base drift and the pnpm 11 upgrade

[Matsuuu]

Summary

The nightly Docker Build Smoke Test has been red since 2026-08-20. Two unrelated causes, the first masking the second.

1. The base image build could not resolve busybox-binsh. DHI dropped busybox 1.38.0_git20260724-r5 from their Alpine 3.24 apk repo and delisted the 24.18.1 / 26.5.1 dev tags. Their busybox package provides only cmd:busybox, so busybox-binsh is what supplies the /bin/sh that ca-certificates, libheif and openssh-server hard-depend on — and it pins busybox=<exact version>, which is checksum-pinned in /etc/apk/world and no longer exists in any configured repo:

breaks: busybox-binsh-1.37.0_git20260817-r33[busybox=1.37.0_git20260817-r33]
satisfies: world[busybox><Q17qiYKlK9RDwttnUVCN54vOnGybE=]

Bumped to DHI's current Alpine 3.24 builds (24.19.0, 26.7.0) with a 22.23.2 digest refresh. /bin/sh stays busybox ash; no image content change beyond the Node patch versions.

Rejected alternatives, each tested against a local reproduction: dropping the busybox-binsh line (apk re-adds it implicitly for the /bin/sh dep), dash-binsh / yash-binsh (both declare D:busybox, so the solver still moves busybox), and unpinning world (apk refuses to downgrade).

2. pnpm 11 pruned the devDependencies the smoke script needs. pnpm 11 verifies dependencies before running a script and reinstalls when the tree looks stale. That fires on pnpm build:docker:smoke, which runs right after build-n8n.mjs has trimmed the frontend manifests and deployed with --prod: the reinstall either fails the frozen-lockfile check against the trimmed manifests, or succeeds as a production install and prunes zx, which the smoke script imports. Introduced by #36424, which does not touch docker/images/** and so never ran this workflow.

• Opt out of the pre-run verification.
• Restore the trimmed manifests in CI too, instead of leaving the working tree mutated. Backups move to a temp dir outside the workspace, since sibling .bak files get packed into compiled/ and would ship inside the image.

How to test

Docker Build Smoke Test passes on this PR — the first green run of the full chain since 2026-08-20.

Base image, against all three refs on both architectures:

docker login dhi.io
docker build --platform linux/amd64 -f docker/images/n8n-base/Dockerfile -t base-check .
docker run --rm base-check sh -c 'node -v; gm version | head -1; readlink -f /bin/sh'

The pnpm behaviour, emulating the CI sequence:

node .github/scripts/trim-fe-packageJson.js
pnpm --filter=n8n --prod --legacy deploy --no-optional /tmp/x
CI=true pnpm build:docker:smoke

Before: ERR_PNPM_OUTDATED_LOCKFILE, or the script starts and dies on a missing zx. After: it runs with dev dependencies intact.

Notes

The published n8nio/base:26.5.1 digest that docker/images/n8n/Dockerfile pins is untouched, so the n8n image build is unaffected. A follow-up moves it onto base:26.7.0 once this merge publishes it.

The DHI change is a re-pin, not a structural fix — it recurs on the next DHI busybox roll, until digest bumps are automated (DEVP-266).

Publishing was checked separately and is unaffected: release-publish.yml runs no pnpm run step after its trim, nested prepack scripts do not trip the verification, and packed manifests carry no unresolved catalog: / workspace: specifiers.

Related Linear tickets, Github issues, and Community forum posts

https://linear.app/n8n/issue/DEVP-869

[n8n-assistant]

PR review overview

Based on ownership of the 4 changed files in this PR:

Ownership	Files owned	Share	Source code	Test files	Misc
@n8n-io/qa-dx	3	75%	+20 / -23	+0 / -0	+0 / -0
@n8n-io/catalysts	1	25%	+4 / -0	+0 / -0	+0 / -0
Total	4	100%	+24 / -23	+0 / -0	+0 / -0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

No issues found across 2 files

Architecture diagram

sequenceDiagram
    participant CI as GHA Workflow (.github/workflows)
    participant Bld as Docker Build Engine
    participant Reg as DHI Registry (dhi.io)
    participant APK as Alpine APK Repository

    Note over CI,APK: Base Image Construction & Dependency Resolution

    CI->>Bld: NEW: Trigger build with updated Node refs (24.19.0 / 26.7.0)
    
    Bld->>Reg: CHANGED: Pull base image using updated digest/tag
    Reg-->>Bld: Base Image Layers (with current busybox binaries)

    Bld->>Bld: Execute Dockerfile instructions (FROM ${DHI_REF})
    
    Bld->>APK: RUN apk add busybox-binsh (and other deps)
    
    alt Dependency Mismatch (Previous state)
        APK-->>Bld: 404/Error: busybox version pin not found in repo
        Bld-->>CI: Build Failure
    else Dependency Satisfied (Current state)
        Note right of APK: APK repo contains busybox version matching base image
        APK-->>Bld: Return compatible busybox-binsh package
        Bld->>Bld: Complete n8n-base image assembly
        Bld-->>CI: Build Success
    end

    Note over Bld: Verify against linux/amd64 and linux/arm64

Loading

_{Re-trigger cubic}