From 6c2b7485fa391845eabcfb1cdbced4652191315d Mon Sep 17 00:00:00 2001 From: David Reed Date: Thu, 22 Oct 2026 10:53:58 -0600 Subject: [PATCH 1/3] [eMudhra 53119][Docker] Move example images off EOL bases and gate ca-certificates The example Dockerfiles used python:3.8.5-slim-buster, python:3.11-alpine3.17 and tiangolo/uvicorn-gunicorn:python3.8-slim, none of which can get the fixed ca-certificates package. Move them to python:3.13-slim-trixie / python:3.13-alpine3.24 and add a ca-certificates version gate to the shipped stage. Adjust what the new bases need: libpcre2-dev for uWSGI, sanic 25.12 (sanic 20 does not build on 3.13), and gunicorn + uvicorn-worker for the FastAPI example that used to get them from the tiangolo image. Co-Authored-By: Claude --- examples/docker/aiohttp/Dockerfile | 23 +++++++++++++++-- examples/docker/asgi/Dockerfile | 16 ++++++++++-- examples/docker/fastapi-gunicorn/Dockerfile | 25 ++++++++++++++++++- .../docker/fastapi-gunicorn/requirements.txt | 4 ++- examples/docker/flask-gunicorn/Dockerfile | 23 +++++++++++++++-- examples/docker/flask-uwsgi/Dockerfile | 25 ++++++++++++++++--- examples/docker/sanic/Dockerfile | 23 +++++++++++++++-- examples/docker/sanic/requirements.txt | 2 +- examples/google_cloud_run/aiohttp/Dockerfile | 22 +++++++++++++++- .../flask-gunicorn/Dockerfile | 22 +++++++++++++++- examples/google_cloud_run/sanic/Dockerfile | 22 +++++++++++++++- .../google_cloud_run/sanic/requirements.txt | 2 +- 12 files changed, 191 insertions(+), 18 deletions(-) diff --git a/examples/docker/aiohttp/Dockerfile b/examples/docker/aiohttp/Dockerfile index a7b78ed12..95626c8a4 100644 --- a/examples/docker/aiohttp/Dockerfile +++ b/examples/docker/aiohttp/Dockerfile @@ -1,13 +1,32 @@ # # docker build . -t your-repo/hello-bolt # -FROM python:3.8.5-slim-buster as builder +FROM python:3.13-slim-trixie AS builder RUN apt-get update && apt-get clean COPY requirements.txt /build/ WORKDIR /build/ RUN pip install -U pip && pip install -r requirements.txt -FROM python:3.8.5-slim-buster as app +FROM python:3.13-slim-trixie AS app +# eMudhra 53119: refresh the OS trust store and fail the build unless the +# ca-certificates package carries the distrust fix for this Debian suite. +ARG CA_CERTIFICATES_REFRESH=2026-10-21 +RUN set -eu; \ + . /etc/os-release; \ + case "$VERSION_CODENAME" in \ + bookworm) min="20250419~deb12u2" ;; \ + trixie) min="20250419+deb13u1" ;; \ + *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \ + esac; \ + apt-get update; \ + apt-get install -y --no-install-recommends ca-certificates; \ + rm -rf /var/lib/apt/lists/*; \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \ + if dpkg --compare-versions "$v" ge "$min"; then \ + echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \ + else \ + echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \ + fi COPY --from=builder /build/ /app/ COPY --from=builder /usr/local/lib/ /usr/local/lib/ WORKDIR /app/ diff --git a/examples/docker/asgi/Dockerfile b/examples/docker/asgi/Dockerfile index cef704967..1951a7ec0 100644 --- a/examples/docker/asgi/Dockerfile +++ b/examples/docker/asgi/Dockerfile @@ -1,12 +1,24 @@ # # docker build . -t your-repo/hello-bolt # -FROM python:3.11-alpine3.17 as builder +FROM python:3.13-alpine3.24 AS builder COPY requirements.txt /build/ WORKDIR /build/ RUN pip install -U pip && pip install -r requirements.txt -FROM python:3.11-alpine3.17 as app +FROM python:3.13-alpine3.24 AS app +# eMudhra 53119: refresh the OS trust store and fail the build unless +# ca-certificates carries the distrust fix (>= 20261020-r0). +ARG CA_CERTIFICATES_REFRESH=2026-10-21 +RUN set -eu; \ + apk add --no-cache --upgrade ca-certificates ca-certificates-bundle; \ + for p in ca-certificates ca-certificates-bundle; do \ + v="$(apk info -e -v "$p" | sed "s/^$p-//")"; \ + if [ "$(apk version -t "$v" 20261020-r0)" = "<" ]; then \ + echo "ca-certificates gate FAILED: $p $v < 20261020-r0" >&2; exit 1; \ + fi; \ + echo "ca-certificates gate OK: $p $v >= 20261020-r0"; \ + done WORKDIR /app/ COPY --from=builder /usr/local/bin/ /usr/local/bin/ COPY --from=builder /usr/local/lib/ /usr/local/lib/ diff --git a/examples/docker/fastapi-gunicorn/Dockerfile b/examples/docker/fastapi-gunicorn/Dockerfile index c8f8b94e3..31481d8d1 100644 --- a/examples/docker/fastapi-gunicorn/Dockerfile +++ b/examples/docker/fastapi-gunicorn/Dockerfile @@ -1,11 +1,34 @@ # # docker build . -t your-repo/hello-bolt # -FROM tiangolo/uvicorn-gunicorn:python3.8-slim +FROM python:3.13-slim-trixie +# eMudhra 53119: refresh the OS trust store and fail the build unless the +# ca-certificates package carries the distrust fix for this Debian suite. +ARG CA_CERTIFICATES_REFRESH=2026-10-21 +RUN set -eu; \ + . /etc/os-release; \ + case "$VERSION_CODENAME" in \ + bookworm) min="20250419~deb12u2" ;; \ + trixie) min="20250419+deb13u1" ;; \ + *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \ + esac; \ + apt-get update; \ + apt-get install -y --no-install-recommends ca-certificates; \ + rm -rf /var/lib/apt/lists/*; \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \ + if dpkg --compare-versions "$v" ge "$min"; then \ + echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \ + else \ + echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \ + fi WORKDIR /app/ COPY *.py /app/ COPY requirements.txt /app/ RUN pip install -U pip && pip install -r requirements.txt +# Previously provided by tiangolo/uvicorn-gunicorn (Python 3.8, EOL): +# gunicorn with uvicorn workers serving $MODULE_NAME:$VARIABLE_NAME on port 80. +ENV MODULE_NAME=main VARIABLE_NAME=app PORT=80 +CMD exec gunicorn --worker-class uvicorn_worker.UvicornWorker --bind "0.0.0.0:$PORT" "$MODULE_NAME:$VARIABLE_NAME" # # docker run -e SLACK_SIGNING_SECRET=$SLACK_SIGNING_SECRET -e SLACK_BOT_TOKEN=$SLACK_BOT_TOKEN -e VARIABLE_NAME="api" -p 80:80 -it your-repo/hello-bolt diff --git a/examples/docker/fastapi-gunicorn/requirements.txt b/examples/docker/fastapi-gunicorn/requirements.txt index e005ac5e5..1b2062eb8 100644 --- a/examples/docker/fastapi-gunicorn/requirements.txt +++ b/examples/docker/fastapi-gunicorn/requirements.txt @@ -1,3 +1,5 @@ slack_bolt fastapi<1 -aiohttp>=3,<4 \ No newline at end of file +aiohttp>=3,<4 +gunicorn>=23 +uvicorn-worker<1 diff --git a/examples/docker/flask-gunicorn/Dockerfile b/examples/docker/flask-gunicorn/Dockerfile index e788cb388..5011af483 100644 --- a/examples/docker/flask-gunicorn/Dockerfile +++ b/examples/docker/flask-gunicorn/Dockerfile @@ -1,12 +1,31 @@ # # docker build . -t your-repo/hello-bolt # -FROM python:3.8.5-slim-buster as builder +FROM python:3.13-slim-trixie AS builder COPY requirements.txt /build/ WORKDIR /build/ RUN pip install -U pip && pip install -r requirements.txt -FROM python:3.8.5-slim-buster as app +FROM python:3.13-slim-trixie AS app +# eMudhra 53119: refresh the OS trust store and fail the build unless the +# ca-certificates package carries the distrust fix for this Debian suite. +ARG CA_CERTIFICATES_REFRESH=2026-10-21 +RUN set -eu; \ + . /etc/os-release; \ + case "$VERSION_CODENAME" in \ + bookworm) min="20250419~deb12u2" ;; \ + trixie) min="20250419+deb13u1" ;; \ + *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \ + esac; \ + apt-get update; \ + apt-get install -y --no-install-recommends ca-certificates; \ + rm -rf /var/lib/apt/lists/*; \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \ + if dpkg --compare-versions "$v" ge "$min"; then \ + echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \ + else \ + echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \ + fi WORKDIR /app/ COPY --from=builder /usr/local/bin/ /usr/local/bin/ COPY --from=builder /usr/local/lib/ /usr/local/lib/ diff --git a/examples/docker/flask-uwsgi/Dockerfile b/examples/docker/flask-uwsgi/Dockerfile index 14ddfb41b..e8f14ac42 100644 --- a/examples/docker/flask-uwsgi/Dockerfile +++ b/examples/docker/flask-uwsgi/Dockerfile @@ -1,15 +1,34 @@ # # docker build . -t your-repo/hello-bolt # -FROM python:3.8.5-slim-buster as builder +FROM python:3.13-slim-trixie AS builder RUN apt-get update \ - && apt-get -y install build-essential libpcre3-dev \ + && apt-get -y install build-essential libpcre2-dev \ && apt-get clean COPY requirements.txt /build/ WORKDIR /build/ RUN pip install -U pip && pip install -r requirements.txt -FROM python:3.8.5-slim-buster as app +FROM python:3.13-slim-trixie AS app +# eMudhra 53119: refresh the OS trust store and fail the build unless the +# ca-certificates package carries the distrust fix for this Debian suite. +ARG CA_CERTIFICATES_REFRESH=2026-10-21 +RUN set -eu; \ + . /etc/os-release; \ + case "$VERSION_CODENAME" in \ + bookworm) min="20250419~deb12u2" ;; \ + trixie) min="20250419+deb13u1" ;; \ + *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \ + esac; \ + apt-get update; \ + apt-get install -y --no-install-recommends ca-certificates; \ + rm -rf /var/lib/apt/lists/*; \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \ + if dpkg --compare-versions "$v" ge "$min"; then \ + echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \ + else \ + echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \ + fi WORKDIR /app/ COPY --from=builder /usr/local/bin/ /usr/local/bin/ COPY --from=builder /usr/local/lib/ /usr/local/lib/ diff --git a/examples/docker/sanic/Dockerfile b/examples/docker/sanic/Dockerfile index 4606e68bd..3d8710ddc 100644 --- a/examples/docker/sanic/Dockerfile +++ b/examples/docker/sanic/Dockerfile @@ -1,12 +1,31 @@ # # docker build . -t your-repo/hello-bolt # -FROM python:3.8.5-slim-buster as builder +FROM python:3.13-slim-trixie AS builder COPY requirements.txt /build/ WORKDIR /build/ RUN pip install -U pip && pip install -r requirements.txt -FROM python:3.8.5-slim-buster as app +FROM python:3.13-slim-trixie AS app +# eMudhra 53119: refresh the OS trust store and fail the build unless the +# ca-certificates package carries the distrust fix for this Debian suite. +ARG CA_CERTIFICATES_REFRESH=2026-10-21 +RUN set -eu; \ + . /etc/os-release; \ + case "$VERSION_CODENAME" in \ + bookworm) min="20250419~deb12u2" ;; \ + trixie) min="20250419+deb13u1" ;; \ + *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \ + esac; \ + apt-get update; \ + apt-get install -y --no-install-recommends ca-certificates; \ + rm -rf /var/lib/apt/lists/*; \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \ + if dpkg --compare-versions "$v" ge "$min"; then \ + echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \ + else \ + echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \ + fi WORKDIR /app/ COPY *.py /app/ COPY --from=builder /usr/local/bin/ /usr/local/bin/ diff --git a/examples/docker/sanic/requirements.txt b/examples/docker/sanic/requirements.txt index f72449c0e..6154cb94f 100644 --- a/examples/docker/sanic/requirements.txt +++ b/examples/docker/sanic/requirements.txt @@ -1,3 +1,3 @@ slack_bolt aiohttp>=3,<4 -sanic>=20,<21 \ No newline at end of file +sanic>=25.12.1,<26 \ No newline at end of file diff --git a/examples/google_cloud_run/aiohttp/Dockerfile b/examples/google_cloud_run/aiohttp/Dockerfile index e4432e3a2..8344a1505 100644 --- a/examples/google_cloud_run/aiohttp/Dockerfile +++ b/examples/google_cloud_run/aiohttp/Dockerfile @@ -11,7 +11,27 @@ # ---------------------------------------------- # Use the official lightweight Python image. # https://hub.docker.com/_/python -FROM python:3.8.5-slim-buster +FROM python:3.13-slim-trixie + +# eMudhra 53119: refresh the OS trust store and fail the build unless the +# ca-certificates package carries the distrust fix for this Debian suite. +ARG CA_CERTIFICATES_REFRESH=2026-10-21 +RUN set -eu; \ + . /etc/os-release; \ + case "$VERSION_CODENAME" in \ + bookworm) min="20250419~deb12u2" ;; \ + trixie) min="20250419+deb13u1" ;; \ + *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \ + esac; \ + apt-get update; \ + apt-get install -y --no-install-recommends ca-certificates; \ + rm -rf /var/lib/apt/lists/*; \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \ + if dpkg --compare-versions "$v" ge "$min"; then \ + echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \ + else \ + echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \ + fi # Allow statements and log messages to immediately appear in the Knative logs ENV PYTHONUNBUFFERED True diff --git a/examples/google_cloud_run/flask-gunicorn/Dockerfile b/examples/google_cloud_run/flask-gunicorn/Dockerfile index 8342e3a8b..cccb1808d 100644 --- a/examples/google_cloud_run/flask-gunicorn/Dockerfile +++ b/examples/google_cloud_run/flask-gunicorn/Dockerfile @@ -11,7 +11,27 @@ # ---------------------------------------------- # Use the official lightweight Python image. # https://hub.docker.com/_/python -FROM python:3.8.5-slim-buster +FROM python:3.13-slim-trixie + +# eMudhra 53119: refresh the OS trust store and fail the build unless the +# ca-certificates package carries the distrust fix for this Debian suite. +ARG CA_CERTIFICATES_REFRESH=2026-10-21 +RUN set -eu; \ + . /etc/os-release; \ + case "$VERSION_CODENAME" in \ + bookworm) min="20250419~deb12u2" ;; \ + trixie) min="20250419+deb13u1" ;; \ + *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \ + esac; \ + apt-get update; \ + apt-get install -y --no-install-recommends ca-certificates; \ + rm -rf /var/lib/apt/lists/*; \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \ + if dpkg --compare-versions "$v" ge "$min"; then \ + echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \ + else \ + echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \ + fi # Allow statements and log messages to immediately appear in the Knative logs ENV PYTHONUNBUFFERED True diff --git a/examples/google_cloud_run/sanic/Dockerfile b/examples/google_cloud_run/sanic/Dockerfile index d71ddef67..09f891e85 100644 --- a/examples/google_cloud_run/sanic/Dockerfile +++ b/examples/google_cloud_run/sanic/Dockerfile @@ -11,7 +11,27 @@ # ---------------------------------------------- # Use the official lightweight Python image. # https://hub.docker.com/_/python -FROM python:3.8.5-slim-buster +FROM python:3.13-slim-trixie + +# eMudhra 53119: refresh the OS trust store and fail the build unless the +# ca-certificates package carries the distrust fix for this Debian suite. +ARG CA_CERTIFICATES_REFRESH=2026-10-21 +RUN set -eu; \ + . /etc/os-release; \ + case "$VERSION_CODENAME" in \ + bookworm) min="20250419~deb12u2" ;; \ + trixie) min="20250419+deb13u1" ;; \ + *) echo "ca-certificates gate: no fixed package known for '$VERSION_CODENAME'" >&2; exit 1 ;; \ + esac; \ + apt-get update; \ + apt-get install -y --no-install-recommends ca-certificates; \ + rm -rf /var/lib/apt/lists/*; \ + v="$(dpkg-query -W -f='${Version}' ca-certificates)"; \ + if dpkg --compare-versions "$v" ge "$min"; then \ + echo "ca-certificates gate OK: $VERSION_CODENAME $v >= $min"; \ + else \ + echo "ca-certificates gate FAILED: $VERSION_CODENAME $v < $min" >&2; exit 1; \ + fi # Allow statements and log messages to immediately appear in the Knative logs ENV PYTHONUNBUFFERED True diff --git a/examples/google_cloud_run/sanic/requirements.txt b/examples/google_cloud_run/sanic/requirements.txt index f72449c0e..6154cb94f 100644 --- a/examples/google_cloud_run/sanic/requirements.txt +++ b/examples/google_cloud_run/sanic/requirements.txt @@ -1,3 +1,3 @@ slack_bolt aiohttp>=3,<4 -sanic>=20,<21 \ No newline at end of file +sanic>=25.12.1,<26 \ No newline at end of file From 961bee76f7f616bf4bd6335b707f5395c4a0ee24 Mon Sep 17 00:00:00 2001 From: David Reed Date: Thu, 22 Oct 2026 11:35:58 -0600 Subject: [PATCH 2/3] [eMudhra 53119][Docker] Use the case-based apk version gate in the asgi example Accept only "=" or ">" from `apk version -t` and treat an empty version as a failure, matching the incident's Alpine gate snippet. Co-Authored-By: Claude --- examples/docker/asgi/Dockerfile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/examples/docker/asgi/Dockerfile b/examples/docker/asgi/Dockerfile index 1951a7ec0..4d828164a 100644 --- a/examples/docker/asgi/Dockerfile +++ b/examples/docker/asgi/Dockerfile @@ -14,10 +14,10 @@ RUN set -eu; \ apk add --no-cache --upgrade ca-certificates ca-certificates-bundle; \ for p in ca-certificates ca-certificates-bundle; do \ v="$(apk info -e -v "$p" | sed "s/^$p-//")"; \ - if [ "$(apk version -t "$v" 20261020-r0)" = "<" ]; then \ - echo "ca-certificates gate FAILED: $p $v < 20261020-r0" >&2; exit 1; \ - fi; \ - echo "ca-certificates gate OK: $p $v >= 20261020-r0"; \ + case "$(apk version -t "${v:-0}" 20261020-r0)" in \ + "="|">") echo "ca-certificates gate OK: $p $v >= 20261020-r0" ;; \ + *) echo "ca-certificates gate FAILED: $p ${v:-missing} < 20261020-r0" >&2; exit 1 ;; \ + esac; \ done WORKDIR /app/ COPY --from=builder /usr/local/bin/ /usr/local/bin/ From 58b85c684633638b714fec589bfebed9d3c49335 Mon Sep 17 00:00:00 2001 From: David Reed Date: Thu, 22 Oct 2026 11:50:37 -0600 Subject: [PATCH 3/3] [eMudhra 53119][Docker] Narrow: keep Python lines, use nearest fixed bases Move the buster images to python:3.8-slim-bookworm (same Python line) instead of python:3.13-slim-trixie, and the asgi image to python:3.11-alpine3.20 (the oldest Alpine whose repo carries 20261020-r0) instead of python:3.13-alpine3.24. The tiangolo FastAPI image is already bookworm, so it keeps its base and only gets the gate. This drops the sanic 20 -> 25 bump, the FastAPI gunicorn/uvicorn-worker requirements and CMD, and the AS casing change. libpcre2-dev stays, since bookworm-slim ships libpcre2-8 but not libpcre3 at runtime. Co-Authored-By: Claude --- examples/docker/aiohttp/Dockerfile | 4 ++-- examples/docker/asgi/Dockerfile | 4 ++-- examples/docker/fastapi-gunicorn/Dockerfile | 6 +----- examples/docker/fastapi-gunicorn/requirements.txt | 4 +--- examples/docker/flask-gunicorn/Dockerfile | 4 ++-- examples/docker/flask-uwsgi/Dockerfile | 4 ++-- examples/docker/sanic/Dockerfile | 4 ++-- examples/docker/sanic/requirements.txt | 2 +- examples/google_cloud_run/aiohttp/Dockerfile | 2 +- examples/google_cloud_run/flask-gunicorn/Dockerfile | 2 +- examples/google_cloud_run/sanic/Dockerfile | 2 +- examples/google_cloud_run/sanic/requirements.txt | 2 +- 12 files changed, 17 insertions(+), 23 deletions(-) diff --git a/examples/docker/aiohttp/Dockerfile b/examples/docker/aiohttp/Dockerfile index 95626c8a4..148921db0 100644 --- a/examples/docker/aiohttp/Dockerfile +++ b/examples/docker/aiohttp/Dockerfile @@ -1,13 +1,13 @@ # # docker build . -t your-repo/hello-bolt # -FROM python:3.13-slim-trixie AS builder +FROM python:3.8-slim-bookworm as builder RUN apt-get update && apt-get clean COPY requirements.txt /build/ WORKDIR /build/ RUN pip install -U pip && pip install -r requirements.txt -FROM python:3.13-slim-trixie AS app +FROM python:3.8-slim-bookworm as app # eMudhra 53119: refresh the OS trust store and fail the build unless the # ca-certificates package carries the distrust fix for this Debian suite. ARG CA_CERTIFICATES_REFRESH=2026-10-21 diff --git a/examples/docker/asgi/Dockerfile b/examples/docker/asgi/Dockerfile index 4d828164a..82b58b27c 100644 --- a/examples/docker/asgi/Dockerfile +++ b/examples/docker/asgi/Dockerfile @@ -1,12 +1,12 @@ # # docker build . -t your-repo/hello-bolt # -FROM python:3.13-alpine3.24 AS builder +FROM python:3.11-alpine3.20 as builder COPY requirements.txt /build/ WORKDIR /build/ RUN pip install -U pip && pip install -r requirements.txt -FROM python:3.13-alpine3.24 AS app +FROM python:3.11-alpine3.20 as app # eMudhra 53119: refresh the OS trust store and fail the build unless # ca-certificates carries the distrust fix (>= 20261020-r0). ARG CA_CERTIFICATES_REFRESH=2026-10-21 diff --git a/examples/docker/fastapi-gunicorn/Dockerfile b/examples/docker/fastapi-gunicorn/Dockerfile index 31481d8d1..c80bc0682 100644 --- a/examples/docker/fastapi-gunicorn/Dockerfile +++ b/examples/docker/fastapi-gunicorn/Dockerfile @@ -1,7 +1,7 @@ # # docker build . -t your-repo/hello-bolt # -FROM python:3.13-slim-trixie +FROM tiangolo/uvicorn-gunicorn:python3.8-slim # eMudhra 53119: refresh the OS trust store and fail the build unless the # ca-certificates package carries the distrust fix for this Debian suite. ARG CA_CERTIFICATES_REFRESH=2026-10-21 @@ -25,10 +25,6 @@ WORKDIR /app/ COPY *.py /app/ COPY requirements.txt /app/ RUN pip install -U pip && pip install -r requirements.txt -# Previously provided by tiangolo/uvicorn-gunicorn (Python 3.8, EOL): -# gunicorn with uvicorn workers serving $MODULE_NAME:$VARIABLE_NAME on port 80. -ENV MODULE_NAME=main VARIABLE_NAME=app PORT=80 -CMD exec gunicorn --worker-class uvicorn_worker.UvicornWorker --bind "0.0.0.0:$PORT" "$MODULE_NAME:$VARIABLE_NAME" # # docker run -e SLACK_SIGNING_SECRET=$SLACK_SIGNING_SECRET -e SLACK_BOT_TOKEN=$SLACK_BOT_TOKEN -e VARIABLE_NAME="api" -p 80:80 -it your-repo/hello-bolt diff --git a/examples/docker/fastapi-gunicorn/requirements.txt b/examples/docker/fastapi-gunicorn/requirements.txt index 1b2062eb8..e005ac5e5 100644 --- a/examples/docker/fastapi-gunicorn/requirements.txt +++ b/examples/docker/fastapi-gunicorn/requirements.txt @@ -1,5 +1,3 @@ slack_bolt fastapi<1 -aiohttp>=3,<4 -gunicorn>=23 -uvicorn-worker<1 +aiohttp>=3,<4 \ No newline at end of file diff --git a/examples/docker/flask-gunicorn/Dockerfile b/examples/docker/flask-gunicorn/Dockerfile index 5011af483..1c1595044 100644 --- a/examples/docker/flask-gunicorn/Dockerfile +++ b/examples/docker/flask-gunicorn/Dockerfile @@ -1,12 +1,12 @@ # # docker build . -t your-repo/hello-bolt # -FROM python:3.13-slim-trixie AS builder +FROM python:3.8-slim-bookworm as builder COPY requirements.txt /build/ WORKDIR /build/ RUN pip install -U pip && pip install -r requirements.txt -FROM python:3.13-slim-trixie AS app +FROM python:3.8-slim-bookworm as app # eMudhra 53119: refresh the OS trust store and fail the build unless the # ca-certificates package carries the distrust fix for this Debian suite. ARG CA_CERTIFICATES_REFRESH=2026-10-21 diff --git a/examples/docker/flask-uwsgi/Dockerfile b/examples/docker/flask-uwsgi/Dockerfile index e8f14ac42..875925147 100644 --- a/examples/docker/flask-uwsgi/Dockerfile +++ b/examples/docker/flask-uwsgi/Dockerfile @@ -1,7 +1,7 @@ # # docker build . -t your-repo/hello-bolt # -FROM python:3.13-slim-trixie AS builder +FROM python:3.8-slim-bookworm as builder RUN apt-get update \ && apt-get -y install build-essential libpcre2-dev \ && apt-get clean @@ -9,7 +9,7 @@ COPY requirements.txt /build/ WORKDIR /build/ RUN pip install -U pip && pip install -r requirements.txt -FROM python:3.13-slim-trixie AS app +FROM python:3.8-slim-bookworm as app # eMudhra 53119: refresh the OS trust store and fail the build unless the # ca-certificates package carries the distrust fix for this Debian suite. ARG CA_CERTIFICATES_REFRESH=2026-10-21 diff --git a/examples/docker/sanic/Dockerfile b/examples/docker/sanic/Dockerfile index 3d8710ddc..03fb26059 100644 --- a/examples/docker/sanic/Dockerfile +++ b/examples/docker/sanic/Dockerfile @@ -1,12 +1,12 @@ # # docker build . -t your-repo/hello-bolt # -FROM python:3.13-slim-trixie AS builder +FROM python:3.8-slim-bookworm as builder COPY requirements.txt /build/ WORKDIR /build/ RUN pip install -U pip && pip install -r requirements.txt -FROM python:3.13-slim-trixie AS app +FROM python:3.8-slim-bookworm as app # eMudhra 53119: refresh the OS trust store and fail the build unless the # ca-certificates package carries the distrust fix for this Debian suite. ARG CA_CERTIFICATES_REFRESH=2026-10-21 diff --git a/examples/docker/sanic/requirements.txt b/examples/docker/sanic/requirements.txt index 6154cb94f..f72449c0e 100644 --- a/examples/docker/sanic/requirements.txt +++ b/examples/docker/sanic/requirements.txt @@ -1,3 +1,3 @@ slack_bolt aiohttp>=3,<4 -sanic>=25.12.1,<26 \ No newline at end of file +sanic>=20,<21 \ No newline at end of file diff --git a/examples/google_cloud_run/aiohttp/Dockerfile b/examples/google_cloud_run/aiohttp/Dockerfile index 8344a1505..c0cbc9ac4 100644 --- a/examples/google_cloud_run/aiohttp/Dockerfile +++ b/examples/google_cloud_run/aiohttp/Dockerfile @@ -11,7 +11,7 @@ # ---------------------------------------------- # Use the official lightweight Python image. # https://hub.docker.com/_/python -FROM python:3.13-slim-trixie +FROM python:3.8-slim-bookworm # eMudhra 53119: refresh the OS trust store and fail the build unless the # ca-certificates package carries the distrust fix for this Debian suite. diff --git a/examples/google_cloud_run/flask-gunicorn/Dockerfile b/examples/google_cloud_run/flask-gunicorn/Dockerfile index cccb1808d..7c76fa745 100644 --- a/examples/google_cloud_run/flask-gunicorn/Dockerfile +++ b/examples/google_cloud_run/flask-gunicorn/Dockerfile @@ -11,7 +11,7 @@ # ---------------------------------------------- # Use the official lightweight Python image. # https://hub.docker.com/_/python -FROM python:3.13-slim-trixie +FROM python:3.8-slim-bookworm # eMudhra 53119: refresh the OS trust store and fail the build unless the # ca-certificates package carries the distrust fix for this Debian suite. diff --git a/examples/google_cloud_run/sanic/Dockerfile b/examples/google_cloud_run/sanic/Dockerfile index 09f891e85..1b2195fda 100644 --- a/examples/google_cloud_run/sanic/Dockerfile +++ b/examples/google_cloud_run/sanic/Dockerfile @@ -11,7 +11,7 @@ # ---------------------------------------------- # Use the official lightweight Python image. # https://hub.docker.com/_/python -FROM python:3.13-slim-trixie +FROM python:3.8-slim-bookworm # eMudhra 53119: refresh the OS trust store and fail the build unless the # ca-certificates package carries the distrust fix for this Debian suite. diff --git a/examples/google_cloud_run/sanic/requirements.txt b/examples/google_cloud_run/sanic/requirements.txt index 6154cb94f..f72449c0e 100644 --- a/examples/google_cloud_run/sanic/requirements.txt +++ b/examples/google_cloud_run/sanic/requirements.txt @@ -1,3 +1,3 @@ slack_bolt aiohttp>=3,<4 -sanic>=25.12.1,<26 \ No newline at end of file +sanic>=20,<21 \ No newline at end of file