This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch hardened-python-base-images in repository https://gitbox.apache.org/repos/asf/airflow.git
commit ac949d76223a3f0d11e37760f60fa857dcc8dbc8 Author: Jarek Potiuk <[email protected]> AuthorDate: Sat Oct 10 13:50:21 2026 +0100 Document the anonymous Debian package repository of the hardened images The trixie hardened images add Docker's own package repository, whose rebuilt packages take precedence over Debian's - users extending the image should know where their packages come from, and that no credentials are needed for it. Generated-by: Claude Opus 5 Claude-Session: https://claude.ai/code/session_014np1fVAxHmGaBFt3qebJ8x --- docker-stack-docs/build.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docker-stack-docs/build.rst b/docker-stack-docs/build.rst index ca4210cb76a..4d1651a98cf 100644 --- a/docker-stack-docs/build.rst +++ b/docker-stack-docs/build.rst @@ -922,6 +922,12 @@ previous images that can matter when you extend or run the image are: ``ldconfig``, no ``dash`` (``/bin/sh`` is ``bash``) and a stripped ``/etc`` - for example without ``/etc/shells`` or the PAM ``common-*`` files. The build restores what Airflow and the Debian packages it installs need; a custom image that relied on something else being present has to install it. +* **Packages also come from Docker's Debian repository.** Next to Debian's own repositories, the Debian 13 + images configure ``http://dhi.io/deb/debian/main`` (``/etc/apt/sources.list.d/dhi.sources``, signed with + ``/usr/share/keyrings/dhi-deb-main.gpg``), which serves Docker's rebuilds of Debian packages. Their + versions carry a ``+dhi<N>`` suffix, so apt prefers them over Debian's builds - in the image and in + images extending it. The repository can be used anonymously: unlike pulling the ``dhi.io`` images, + installing packages from it needs no ``docker login`` or any other credentials. * **Some OS files are modified.** ``/etc/os-release`` identifies the system as "Docker Hardened Images (Debian)", and ``/etc/debian_version`` differs from the Debian package's copy, so an ``apt-get upgrade`` that touches ``base-files`` would stop at ``dpkg``'s interactive configuration-file prompt. The image
