Repository navigation
fix(privacy-backup): hold the PostgreSQL and PostGIS packages at the pinned image - #688
Merged
Merged
Conversation
…pinned image apt-get upgrade installed PostGIS 3.7.0's SQL scripts over the 3.6.4 library, which the PostgreSQL repository had not yet published, so every backup restore failed at CREATE EXTENSION postgis and CI on main broke. Hold postgresql, postgis and libpq at the pinned image's versions, keep upgrading everything else, and fail the build if the PostGIS library and scripts ever differ.
Medformatik
added
the
docker
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed and why
CI on main has failed since #687 merged. The cause is not #687. The
test (database, export-restore)job builds the privacy-backup collector image fresh, and the retained-backup fixture's restore stopped withBrokenPipeError(re-running gave the same result).The collector's Dockerfile runs
apt-get upgrade -yover the pinned PostGIS image. The PostgreSQL apt repository has now published PostGIS 3.7.0's SQL scripts (postgresql-18-postgis-3-scripts) but not its library, so the upgrade installs mismatched halves:The dump restore then fails at
CREATE EXTENSION postgis:psql(withON_ERROR_STOP) exits, and the exporter's next write hits the closed pipe. #687 only happened to be the first main build to rebuild that layer after the publish. The same job had passed in #687's PR run and on the previous two main commits.The Dockerfile already says the restore engine must match the deployment's pinned PostgreSQL/PostGIS image, and the blanket upgrade broke that. The fix:
postgresql*,postgis*andlibpq*package at the pinned image's version. Other distribution packages still get their security updates; the existing Brotli minimum check still passes.bash -o pipefailto satisfy hadolint.A release built from main now would have shipped the broken collector, since this image is rebuilt whenever its inputs change. The production collector still runs an earlier, matching build.
Verification
--no-cachebuild of main's Dockerfile has the mismatched packages, andCREATE EXTENSION postgisin it fails with the error above.--no-cachebuild with this change holdspostgresql-18,libpq5,postgresql-18-postgis-3and its scripts at the pinned image's versions (18.6, PostGIS 3.6.4), and still upgradeslibbrotli1to1.1.0-2+deb13u1.node services/ops-agent/privacy-backup/test-fixture.mjs, the failing CI step, passes against that image.USER postgres) is unchanged from main.pnpm check:policy,pnpm check-dockerfile-sync,pnpm check-infrastructureand the Docker release-contract tests pass.Release and upgrade impact
Product impact: ordinary
No package release: only the privacy-backup collector's Dockerfile changes; neither published package is affected.