This is an automated email from the ASF dual-hosted git repository. potiuk pushed a commit to branch mirror-hardened-images-more-often in repository https://gitbox.apache.org/repos/asf/airflow.git
commit d7fdb3198efc24fb67c4f1d95176eb61174908be Author: Jarek Potiuk <[email protected]> AuthorDate: Fri Oct 30 09:58:52 2026 +0100 Refresh the hardened base image mirror every six hours Docker rebuilds the hardened images in place and moves the dhi.io apt repository on at the same time. With a weekly mirror, the base images Airflow builds on lag the repository by up to a week, and any apt install whose dependencies were rebuilt in between fails: build-essential currently cannot be installed because the mirrored base has an older libbz2 than the bzip2 the repository offers (docker-hardened-images/catalog#689). Mirroring copies manifests between registries without pulling layers, so running it several times a day is cheap. Generated-by: Claude Opus 5 --- .github/workflows/mirror-hardened-base-images.yml | 8 +++++--- docker-stack-docs/build.rst | 4 ++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/mirror-hardened-base-images.yml b/.github/workflows/mirror-hardened-base-images.yml index b7eac54c318..55ab27b4d94 100644 --- a/.github/workflows/mirror-hardened-base-images.yml +++ b/.github/workflows/mirror-hardened-base-images.yml @@ -30,9 +30,11 @@ name: Mirror hardened base images on: # yamllint disable-line rule:truthy workflow_dispatch: schedule: - # Docker rebuilds the hardened images as CVEs are fixed, keeping the same tags. Re-running - # weekly is what picks those rebuilds up. - - cron: '27 4 * * 1' + # Docker rebuilds the hardened images as CVEs are fixed, keeping the same tags, and moves the + # dhi.io apt repository on at the same time. A stale mirror then cannot install packages whose + # dependencies were rebuilt (docker-hardened-images/catalog#689), so it is refreshed several + # times a day rather than weekly. + - cron: '27 */6 * * *' permissions: contents: read concurrency: diff --git a/docker-stack-docs/build.rst b/docker-stack-docs/build.rst index 24496484d6d..b2b113c0b9d 100644 --- a/docker-stack-docs/build.rst +++ b/docker-stack-docs/build.rst @@ -964,8 +964,8 @@ previous images that can matter when you extend or run the image are: it. A package upgrade therefore does not replace a configuration file that differs from the package's version. * **The tags are rebuilt in place.** Docker republishes the same tags as CVEs are fixed, and Airflow - refreshes its mirror weekly, so rebuilding an image from the same ``BASE_IMAGE`` tag can pick up a newer - base. The weekly mirror also copies the newest Python patch release Docker publishes, and Airflow's + refreshes its mirror every six hours, so rebuilding an image from the same ``BASE_IMAGE`` tag can pick up + a newer base. The mirror also copies the newest Python patch release Docker publishes, and Airflow's regular dependency upgrade moves the pinned patch level to it, so the images follow Docker's releases rather than python.org's.
