Skip to content

Conversation

@jnoordsij
Copy link
Contributor

Modelled after #540.

Requires docker-library/official-images#20400.

This PR updates Alpine to the latest stable version: 3.23.

See also https://wiki.alpinelinux.org/wiki/Release_Notes_for_Alpine_3.23.0.

@yosifkit yosifkit closed this Dec 3, 2025
@yosifkit yosifkit reopened this Dec 3, 2025
; do \
# "iptables-save" -> "iptables-legacy-save", "ip6tables" -> "ip6tables-legacy", etc.
# https://pkgs.alpinelinux.org/contents?branch=v3.22&name=iptables-legacy&arch=x86_64
# https://pkgs.alpinelinux.org/contents?branch=v3.23&name=iptables-legacy&arch=x86_64
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oof, this isn't right - iptables-legacy appears to be gone now? why was the build successful? 🤔

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Huh, I guess this is just a case of pkgs.alpinelinux.org not being updated yet?

$ docker run -it --rm --pull=always alpine:3.23
3.23: Pulling from library/alpine
Digest: sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375
Status: Image is up to date for alpine:3.23
/ # apk add --no-cache iptables-legacy
(1/4) Installing libip4tc (1.8.11-r1)
(2/4) Installing libip6tc (1.8.11-r1)
(3/4) Installing libxtables (1.8.11-r1)
(4/4) Installing iptables-legacy (1.8.11-r1)
Executing busybox-1.37.0-r29.trigger
OK: 8 MiB in 20 packages

🤷

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I just 'gambled' with the URL, weird that it's still not there. Seems like the same thing happened last time around:
#539 (comment)

I did look at edge and figured as long as it still appears there, it will likely still be around in the stable releases.

Copy link
Member

@tianon tianon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥇

@tianon tianon merged commit 94bbcfa into docker-library:master Dec 3, 2025
7 of 8 checks passed
docker-library-bot added a commit to docker-library-bot/official-images that referenced this pull request Dec 3, 2025
Changes:

- docker-library/docker@94bbcfa: Merge pull request docker-library/docker#566 from jnoordsij/alpine3.23
yosifkit pushed a commit to docker-library/official-images that referenced this pull request Dec 4, 2025
Changes:

- docker-library/docker@94bbcfa: Merge pull request docker-library/docker#566 from jnoordsij/alpine3.23

Co-authored-by: Docker Library Bot <doi+docker-library-bot@docker.com>
@jnoordsij jnoordsij deleted the alpine3.23 branch December 4, 2025 08:59
@chadlwilson
Copy link

chadlwilson commented Dec 6, 2025

FYI - this update seems to be causing some QEMU issue with apk/busybox (e.g when using buildx/buildkit to build something cross-platform within this DIND image): https://gitlab.alpinelinux.org/alpine/aports/-/issues/17775

May or may not be of relevance to your decision to keep Alpine 3.23 as the primary for the official images, depending on how obscure the root cause of problem turns out to be.

@yosifkit
Copy link
Member

yosifkit commented Dec 8, 2025

That looks a lot like docker-library/ruby#521 and is not related to the image as far as I can tell.

@chadlwilson
Copy link

chadlwilson commented Dec 8, 2025

As linked on that issue, and subsequently discussed upstream in https://gitlab.alpinelinux.org/alpine/aports/-/issues/17775 it's primary a QEMU issue/bug, but triggered by a change to the way apk-tools v3 executes triggers as part of Alpine 3.23.

But it's possibly relevant insofar as the blast radius is likely to be very wide as every base image that updates to Alpine 3.23 will have broken multi-arch builds of child images with buildkit and QEMU (until/unless apk can be updated across all such base images).

If folks need to lock to Alpine 3.22 to workaround, that will also prevent (security) patches from regular image rebuilds from coming through for images which don't maintain parallel tags for 3.22 and 3.23 and otherwise treat Alpine as a rolling release (e.g docker:dind).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants