From 28266b4441c65d6f222c5b3e0effb720bd8f87e5 Mon Sep 17 00:00:00 2001 From: Logan Cusano Date: Thu, 20 Aug 2026 03:01:38 -0400 Subject: [PATCH] Pin the op25 container to a Python major version `python:slim-trixie` carried no version at all, so a rebuild could move the interpreter across a major release without anything in the repo changing. That is not hypothetical here: app/models.py referenced IcecastConfig about 85 lines before its definition and ran only because trixie currently ships Python 3.14, where PEP 649 defers annotation evaluation. On 3.13 it was a hard NameError. The ordering was fixed on 2026-08-16; the unpinned base outlived it. Pinned to 3.14-slim rather than 3.14-slim-trixie so it matches drb-edge-node, which was already on 3.14-slim. Patch releases still float, which is what we want for security updates -- only the major version is nailed down. Every other Dockerfile in both repos already pinned a major version (python:3.12-slim, python:3.14-slim, node:20-slim, debian:bookworm-slim), so this was the only genuinely unpinned base image, despite server-26#11 claiming none of them were pinned. Closes logan/server-26#11 (filed against the wrong repo -- the file lives in the client repo). --- op25-container/Dockerfile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/op25-container/Dockerfile b/op25-container/Dockerfile index b0c2ffc..ec22fdc 100644 --- a/op25-container/Dockerfile +++ b/op25-container/Dockerfile @@ -1,5 +1,10 @@ # OP25 Core Container -FROM python:slim-trixie +# Pinned to a Python major version deliberately. The bare `slim-trixie` tag +# carries no version at all, so a rebuild could move the interpreter across a +# major release -- which this repo has already been bitten by once, when +# app/models.py only ran because trixie happened to ship 3.14 and PEP 649 +# defers annotation evaluation. Matches drb-edge-node, which is already 3.14. +FROM python:3.14-slim # Set environment variables ENV DEBIAN_FRONTEND=noninteractive