Switch official Docker images to Debian Trixie

.github/workflows/ci-image-build.yml

@@ -62,9 +62,9 @@ on:  # yamllint disable-line rule:truthy
         required: true
         type: string
       debian-version:
-        description: "Base Debian distribution to use for the build (bookworm)"
+        description: "Base Debian distribution to use for the build (trixie/bookworm)"
         type: string
-        default: "bookworm"
+        default: "trixie"
       install-mysql-client-type:
         description: "MySQL client type to use during build (mariadb/mysql)"
         type: string

.github/workflows/prod-image-build.yml

@@ -61,9 +61,9 @@ on:  # yamllint disable-line rule:truthy
         default: "false"
         type: string
       debian-version:
-        description: "Base Debian distribution to use for the build (bookworm)"
+        description: "Base Debian distribution to use for the build (trixie/bookworm)"
         type: string
-        default: "bookworm"
+        default: "trixie"
       install-mysql-client-type:
         description: "MySQL client type to use during build (mariadb/mysql)"
         type: string

.github/workflows/push-image-cache.yml

@@ -37,9 +37,9 @@ on:  # yamllint disable-line rule:truthy
         required: true
         type: string
       debian-version:
-        description: "Base Debian distribution to use for the build (bookworm)"
+        description: "Base Debian distribution to use for the build (trixie/bookworm)"
         type: string
-        default: "bookworm"
+        default: "trixie"
       install-mysql-client-type:
         description: "MySQL client type to use during build (mariadb/mysql)"
         type: string

Dockerfile

@@ -50,7 +50,7 @@ ARG AIRFLOW_USER_HOME_DIR=/home/airflow
 # latest released version here
 ARG AIRFLOW_VERSION="3.3.1"
 
-ARG BASE_IMAGE="debian:bookworm-slim"
+ARG BASE_IMAGE="debian:trixie-slim"
 ARG AIRFLOW_PYTHON_VERSION="3.13.15"
 
 # PYTHON_LTO: Controls whether Python is built with Link-Time Optimization (LTO).
@@ -142,8 +142,23 @@ else
     exit 1
 fi
 
+function get_debian_version() {
+    # Get debian version without installing lsb_release
+    # shellcheck disable=SC1091
+    . /etc/os-release
+    printf '%s\n' "${VERSION_CODENAME}"
+}
+
 function get_dev_apt_deps() {
     if [[ "${DEV_APT_DEPS=}" == "" ]]; then
+        local debian_version
+        local debian_version_apt_deps=""
+        debian_version="$(get_debian_version)"
+        if [[ "${debian_version}" == "bookworm" ]]; then
+            debian_version_apt_deps="\
+lzma-dev \
+"
+        fi
         DEV_APT_DEPS="\
 apt-transport-https \
 apt-utils \
@@ -155,7 +170,6 @@ git \
 graphviz \
 graphviz-dev \
 krb5-user \
-lcov \
 ldap-utils \
 libbluetooth-dev \
 libbz2-dev \
@@ -185,7 +199,7 @@ libzstd-dev \
 locales \
 lsb-release \
 lzma \
-lzma-dev \
+${debian_version_apt_deps}\
 openssh-client \
 openssl \
 pkg-config \
@@ -206,21 +220,40 @@ zlib1g-dev \
     fi
 }
 
+function get_post_python_dev_apt_deps() {
+    if [[ "${POST_PYTHON_DEV_APT_DEPS=}" == "" ]]; then
+        POST_PYTHON_DEV_APT_DEPS="\
+lcov \
+"
+        export POST_PYTHON_DEV_APT_DEPS
+    fi
+}
+
 function get_runtime_apt_deps() {
     local debian_version
     local debian_version_apt_deps
-    # Get debian version without installing lsb_release
-    # shellcheck disable=SC1091
-    debian_version=$(. /etc/os-release;   printf '%s\n' "$VERSION_CODENAME";)
+    debian_version="$(get_debian_version)"
     echo
     echo "DEBIAN CODENAME: ${debian_version}"
     echo
-    debian_version_apt_deps="\
+    if [[ "${debian_version}" == "bookworm" ]]; then
+        debian_version_apt_deps="\
 libffi8 \
 libldap-2.5-0 \
 libssl3 \
 netcat-openbsd\
 "
+    elif [[ "${debian_version}" == "trixie" ]]; then
+        debian_version_apt_deps="\
+libffi8 \
+libldap2 \
+libssl3t64 \
+netcat-openbsd\
+"
+    else
+        echo "ERROR! Unsupported Debian version: ${debian_version}."
+        exit 1
+    fi
     echo
     echo "APPLIED INSTALLATION CONFIGURATION FOR DEBIAN VERSION: ${debian_version}"
     echo
@@ -286,10 +319,7 @@ function install_debian_dev_dependencies() {
     fi
     apt-get update
     local debian_version
-    local debian_version_apt_deps
-    # Get debian version without installing lsb_release
-    # shellcheck disable=SC1091
-    debian_version=$(. /etc/os-release;   printf '%s\n' "$VERSION_CODENAME";)
+    debian_version="$(get_debian_version)"
     echo
     echo "DEBIAN CODENAME: ${debian_version}"
     echo
@@ -304,6 +334,13 @@ function install_additional_dev_dependencies() {
     fi
 }
 
+function install_post_python_dev_dependencies() {
+    if [[ "${POST_PYTHON_DEV_APT_DEPS=}" != "" ]]; then
+        # shellcheck disable=SC2086
+        apt-get install -y --no-install-recommends ${POST_PYTHON_DEV_APT_DEPS}
+    fi
+}
+
 function link_python() {
     # link python binaries to /usr/local/bin and /usr/python/bin with and without 3 suffix
     # Links in /usr/local/bin are needed for tools that expect python to be there
@@ -374,20 +411,27 @@ function install_cosign() {
 }
 
 function install_python() {
-    # If system python (3.11 in bookworm) is installed (via automatic installation of some dependencies for example), we need
-    # to fail and make sure that it is not there, because there can be strange interactions if we install
-    # newer version and system libraries are installed, because
-    # when you create a virtualenv part of the shared libraries of Python can be taken from the system
-    # Installation leading to weird errors when you want to install some modules - for example when you install ssl:
-    # /usr/python/lib/python3.11/lib-dynload/_ssl.cpython-311-aarch64-linux-gnu.so: undefined symbol: _PyModule_Add
-    if dpkg -l | grep '^ii' | grep '^ii  libpython' >/dev/null; then
+    # Airflow images build and use their own Python under /usr/python. If Debian's system Python
+    # is installed before that custom Python is built, native extensions can accidentally link
+    # against a mix of system Python libraries and /usr/python libraries. That can produce hard to
+    # diagnose import/linker errors later.
+    local installed_libpython_packages
+    installed_libpython_packages="$(
+        dpkg-query -W -f='${db:Status-Abbrev} ${binary:Package}\n' 'libpython*' 2>/dev/null \
+            | awk '$1 ~ /^ii/ {print $2}' \
+            | sort || true
+    )"
+    if [[ "${installed_libpython_packages}" != "" ]]; then
         echo
         echo "ERROR! System python is installed by one of the previous steps"
         echo
-        echo "Please make sure that no python packages are installed by default. Displaying the reason why libpython3.11 is installed:"
+        echo "Please make sure that no python packages are installed by default. Displaying why these packages are installed:"
+        echo "${installed_libpython_packages}"
         echo
         apt-get install -yqq aptitude >/dev/null
-        aptitude why libpython3.11
+        while read -r libpython_package; do
+            aptitude why "${libpython_package}" || true
+        done <<< "${installed_libpython_packages}"
         echo
         exit 1
     else
@@ -587,8 +631,10 @@ if [[ "${INSTALLATION_TYPE}" == "RUNTIME" ]]; then
     apt_clean
 else
     get_dev_apt_deps
+    get_post_python_dev_apt_deps
     install_debian_dev_dependencies
     install_python
+    install_post_python_dev_dependencies
     install_additional_dev_dependencies
     install_rustup
     if [[ "${INSTALLATION_TYPE}" == "CI" ]]; then
@@ -611,7 +657,18 @@ set -euo pipefail
 common::get_colors
 declare -a packages
 
-readonly MARIADB_LTS_VERSION="10.11"
+get_mariadb_lts_version() {
+    local debian_version
+    debian_version="$(lsb_release -cs)"
+    if [[ "${debian_version}" == "bookworm" ]]; then
+        printf "10.11\n"
+    elif [[ "${debian_version}" == "trixie" ]]; then
+        printf "11.8\n"
+    else
+        echo "${COLOR_RED}Unsupported Debian version: ${debian_version}.${COLOR_RESET}" >&2
+        exit 1
+    fi
+}
 
 : "${INSTALL_MYSQL_CLIENT:?Should be true or false}"
 : "${INSTALL_MYSQL_CLIENT_TYPE:-mariadb}"
@@ -674,6 +731,8 @@ install_mariadb_client() {
     # that some of packages might contains `-compat` suffix, Debian repo -> MariaDB repo:
     # `libmariadb-dev` -> `libmariadb-dev-compat`
     # `mariadb-client-core` -> `mariadb-client` or `mariadb-client-compat` (11+)
+    local mariadb_lts_version
+    mariadb_lts_version="$(get_mariadb_lts_version)"
     if [[ "${1}" == "dev" ]]; then
         packages=("libmariadb-dev-compat" "mariadb-client")
     elif [[ "${1}" == "prod" ]]; then
@@ -684,15 +743,18 @@ install_mariadb_client() {
         echo
         exit 1
     fi
+    if [[ "${mariadb_lts_version}" == 11.* ]]; then
+        packages+=("mariadb-client-compat")
+    fi
 
     common::import_trusted_gpg "0xF1656F24C74CD1D8" "mariadb"
 
     echo
-    echo "${COLOR_BLUE}Installing MariaDB client version ${MARIADB_LTS_VERSION}: ${1}${COLOR_RESET}"
+    echo "${COLOR_BLUE}Installing MariaDB client version ${mariadb_lts_version}: ${1}${COLOR_RESET}"
     echo "${COLOR_YELLOW}MariaDB client protocol-compatible with MySQL client.${COLOR_RESET}"
     echo
 
-    echo "deb [arch=amd64,arm64] https://archive.mariadb.org/mariadb-${MARIADB_LTS_VERSION}/repo/debian/ $(lsb_release -cs) main" > \
+    echo "deb [arch=amd64,arm64] https://archive.mariadb.org/mariadb-${mariadb_lts_version}/repo/debian/ $(lsb_release -cs) main" > \
         /etc/apt/sources.list.d/mariadb.list
     # Make sure that dependencies from MariaDB repo are preferred over Debian dependencies
     printf "Package: *\nPin: release o=MariaDB\nPin-Priority: 999\n" > /etc/apt/preferences.d/mariadb
@@ -730,7 +792,7 @@ function install_mssql_client() {
     fi
     packages=("msodbcsql18")
 
-    common::import_trusted_gpg "EB3E94ADBE1229CF" "microsoft"
+    common::import_trusted_gpg "EE4D7792F748182B" "microsoft"
 
     echo
     echo "${COLOR_BLUE}Installing mssql client${COLOR_RESET}"