From b3df285220c9d9baf5a9b623ed58a2f653cf4413 Mon Sep 17 00:00:00 2001 From: Clemens Hahn Date: Thu, 30 Jul 2026 11:35:18 +0200 Subject: [PATCH] Pin the base image and create the runtime user with groupadd/useradd The build stopped working without a commit touching it: `condaforge/miniforge3:latest` moved on to a base that ships neither `addgroup` nor `adduser`, so `RUN addgroup --system ... && adduser --system ...` failed and no release image could be published. Switch to `groupadd`/`useradd`, which the image does provide, and pin the base tag in both the runtime and the test image so it cannot drift again. `--create-home` keeps the writable HOME that `adduser --system` used to provide and that conda needs while creating the environment. Co-Authored-By: Claude Opus 5 --- Dockerfile | 5 +++-- test/Dockerfile | 3 ++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 7ed4763..50b8d35 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,5 @@ -FROM condaforge/miniforge3:latest +# pinned: a floating tag silently moved this image to a base without `adduser`, breaking the build +FROM condaforge/miniforge3:26.3.2-3 LABEL org.opencontainers.image.authors="us@couchbits.com" LABEL org.opencontainers.image.vendor="couchbits GmbH" @@ -9,7 +10,7 @@ RUN mkdir $PROJECT_DIR # Security Aspects ENV UID=moveapps ENV GID=moveapps -RUN addgroup --system $GID && adduser --system $UID --ingroup $GID +RUN groupadd --system $GID && useradd --system --gid $GID --create-home $UID RUN chown $UID:$GID $PROJECT_DIR USER $UID:$GID diff --git a/test/Dockerfile b/test/Dockerfile index 784e412..dac5703 100644 --- a/test/Dockerfile +++ b/test/Dockerfile @@ -1,4 +1,5 @@ -FROM condaforge/miniforge3:latest +# pinned for the same reason as the runtime image: keep the test base from drifting +FROM condaforge/miniforge3:26.3.2-3 LABEL org.opencontainers.image.authors="us@couchbits.com" LABEL org.opencontainers.image.vendor="couchbits GmbH"