This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow-steward.git
The following commit(s) were added to refs/heads/main by this push:
new 18729435 docs(setup): note the pinned bubblewrap is unavailable on
Debian bookworm (#572)
18729435 is described below
commit 18729435b388d528f0bb43a1b3d973d1b88b59e4
Author: Shahar Epstein <[email protected]>
AuthorDate: Fri Jun 26 18:05:45 2026 +0300
docs(setup): note the pinned bubblewrap is unavailable on Debian bookworm
(#572)
The Debian/Ubuntu apt block pins bubblewrap 0.11.2, but Debian stable
(bookworm) ships an older bubblewrap and an adopter reported the 0.11.x
line not working there. Document, alongside the existing Ubuntu Noble
shortcut, that the supported path is Debian trixie (which ships 0.11.x),
with the bookworm/older-version fallback pointing at the same LTS
trade-off as Noble.
Reported by the Apache Airflow security team while setting up the
secure agent environment.
Generated-by: Claude Code (Opus 4.8)
---
docs/setup/secure-agent-setup.md | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/docs/setup/secure-agent-setup.md b/docs/setup/secure-agent-setup.md
index 584c04b0..dc29d7ef 100644
--- a/docs/setup/secure-agent-setup.md
+++ b/docs/setup/secure-agent-setup.md
@@ -239,6 +239,16 @@ sudo apt-get install --no-install-recommends \
socat=1.8.1.1-*
```
+> **Debian stable (bookworm) caveat.** The pinned `bubblewrap 0.11.2`
+> is not available on Debian bookworm — bookworm ships an older
+> `bubblewrap`, and an adopter reported the `0.11.x` line not working
+> there. `0.11.x` ships in **Debian trixie**, so the supported path is
+> to run the secure setup on **trixie** (or newer). If you must stay on
+> bookworm, install the older distro `bubblewrap` and accept the same
+> LTS trade-off documented in the Ubuntu Noble shortcut below — the
+> sandbox flags don't depend on a specific bubblewrap version (the
+> `denyRead`/`allowRead` API has been stable since `0.6.x`).
+
**Fedora / RHEL (dnf)**:
```bash
