Fix CI image builds by moving off end-of-life Debian 11 - #1410
Conversation
Debian 11 (bullseye) LTS ended on 2026-08-31 and its security package pool is being pruned, so every image build now fails at apt-get with a 404 on a package the index still lists. Switch the three python:3.11.11-slim bases from bullseye to bookworm; the Python version is unchanged. Co-Authored-By: Claude <noreply@anthropic.com>
✅ Deploy Preview for antenna-preview canceled.
|
✅ Deploy Preview for antenna-ssec canceled.
|
|
Warning Review limit reachedNext included review available in 47 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
🟢 Approval recommended
The change is a minimal, targeted base-image update consistent with the PR description, with no remaining bullseye references under compose/ and low functional risk beyond OS package updates.
Pull request overview
Updates the Docker base images used for backend (local + production) and docs builds from Debian 11 (bullseye, now EOL and causing apt-get 404s in CI) to Debian 12 (bookworm) while keeping the backend Python pin at 3.11.11 to restore reliable image builds across CI/local/production.
Changes:
- Switch production Django image base to
python:3.11.11-slim-bookworm. - Switch local Django image base to
python:3.11.11-slim-bookworm. - Switch local docs image base to
python:3.11.11-slim-bookworm(from 3.11.4 on bullseye).
File summaries
| File | Description |
|---|---|
| compose/production/django/Dockerfile | Moves production Django base image from bullseye to bookworm to prevent CI build failures from pruned Debian 11 security pools. |
| compose/local/django/Dockerfile | Moves local Django base image from bullseye to bookworm to match production and keep local builds aligned/stable. |
| compose/local/docs/Dockerfile | Moves docs image off bullseye to bookworm and aligns Python patch version with the backend images. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Summary
Every backend CI run has failed since 2026-09-04, on
mainas well as on open pull requests, because the Django image can no longer be built. The images are based on Debian 11 (bullseye), whose long-term support ended on 2026-08-31, and its security package pool is now being pruned:apt-get installfetches a package the index still lists and gets a 404 (libperl5.32 … deb11u5on one run,xz-utils … deb11u2on the next). Retrying does not help; five reruns across five CDN edges all failed.This moves the images to Debian 12 (bookworm), which is supported until 2028. The Python version stays at 3.11.11, so nothing about the application's runtime changes apart from the operating-system packages underneath it.
List of Changes
compose/local/django/Dockerfileandcompose/production/django/Dockerfilenow start frompython:3.11.11-slim-bookworminstead ofpython:3.11.11-slim-bullseye.compose/local/docs/Dockerfilemoves frompython:3.11.4-slim-bullseyetopython:3.11.11-slim-bookworm.Verification
Both the local and the production Django images were built locally from this branch with
--no-cache, so the apt step really ran against bookworm rather than a cached layer. In both imagespython -c "import django, psycopg, PIL, numpy"succeeds andpip checkreports no broken requirements. The CI run on this pull request is the end-to-end check that the build step and the test suite pass on the new base.Debian 13 (trixie) was considered and left for later: the official Python images do not publish a
3.11.11-slim-trixietag, so moving to 13 would also mean changing the pinned Python patch version.