a34381fd

backup: the image takes its fixes from the distro too

a73x 2026-09-05 18:33

Commit message

backup: the image takes its fixes from the distro too

The site image's base-tag lag applies here for the same reason: alpine:3.24
predates the openssl advisory that Alpine had already fixed in its package
repo, so the first build of this image refused its own scan. The backup
image is deliberately not versioned against a release, so this rides
outside the v0.0.8 tag exactly as the image itself does.

RETRO.md

Old		New
@@ -87,3 +87,8 @@ One line per push to `main`: what slowed the work down. Enforced by
87	the distro, so a build is only as current as whenever upstream last rebuilt;	87	the distro, so a build is only as current as whenever upstream last rebuilt;
88	taking the upgrade at build time is the difference between shipping and	88	taking the upgrade at build time is the difference between shipping and
89	waiting on someone else's release cadence.	89	waiting on someone else's release cadence.
		90	- Backup image: the same base-tag lag as the site image, found one stage later
		91	and only on prod. BACKUPS=1 is a prod-only setting, so the new BACKUP_IMAGE
		92	requirement had never been exercised — stg proved nine stages and still could
		93	not have caught this. A plane-specific config gate is only proven on the plane
		94	that sets it.

deploy/server/backup.Dockerfile

Old		New
@@ -13,7 +13,10 @@
13	# quietly pass anything found in it. Bump when this line goes EOL too.	13	# quietly pass anything found in it. Bump when this line goes EOL too.
14	FROM docker.io/library/alpine:3.24	14	FROM docker.io/library/alpine:3.24
15		15
16	RUN apk add --no-cache sqlite	16	# The base tag lags Alpine's own package repo, so an image built while an
		17	# advisory is open carries the vulnerable package and scan-image refuses it.
		18	# Take the distro's fixes here rather than waiting for the base to be rebuilt.
		19	RUN apk --no-cache upgrade && apk add --no-cache sqlite
17		20
18	# Backups are written to a mounted PVC as root; the job creates /data/backups.	21	# Backups are written to a mounted PVC as root; the job creates /data/backups.
19	ENTRYPOINT ["/bin/sh", "-c"]	22	ENTRYPOINT ["/bin/sh", "-c"]