Repository navigation
feat: rebuild the official ruby:X.Y.Z-bookworm image on demand - #29
Merged
Merged
Conversation
Replace the bullseye-slim image (Debian LTS ended 2026-08-31) with the docker-library bookworm template, version and checksum as build args, so zenjoy/ruby:X.Y.Z-bookworm is a drop-in for ruby:X.Y.Z-bookworm when a Ruby security release lands before the official image. - build.yml: manual dispatch with version + SHA256 (cross-checked against cache.ruby-lang.org index.txt), amd64 + arm64 on hosted runners, smoke test, X.Y.Z-bookworm and X.Y-bookworm tags on Docker Hub and GHCR, cosign signatures; PRs build and smoke-test without pushing - drop the weekly matrix rebuild - bump actions to current majors - fix: YJIT was never enabled for Ruby 4.x (minor >= 2 check)
This was referenced Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ruby 4.0.8 and 4.0.9 shipped fixes for an Onigmo regex overflow (the root cause of GitLab's CVE-2026-110264). The official
ruby:*-bookwormimages showed up 16 to 22 hours after each release. This repo used to cover that gap, but it had drifted: bullseye-slim base (Debian LTS ended in August), last image 4.0.1, weekly schedule disabled by GitHub for inactivity. Nimbu switched to the official image in January.This turns it into a break-glass mirror of the official image instead of a separate flavour.
Dockerfile: docker-library's
4.0/bookwormtemplate, with only the Ruby version and SHA256 turned into build args. Samebuildpack-deps:bookwormbase, YJIT, ZJIT (4.x only), full RELRO, sameGEM_HOME/BUNDLE_*env. Sozenjoy/ruby:4.0.9-bookwormcan replaceruby:4.0.9-bookwormin Nimbu'sBASE_IMAGEwithout touching the Aptfile.build.yml:
cache.ruby-lang.org/pub/ruby/index.txt, so a typo or a doctored value fails before anything builds.ubuntu-24.04,ubuntu-24.04-arm) instead of the 2-core larger ARM runner.X.Y.Z-bookwormandX.Y-bookwormon Docker Hub and GHCR, nolatest. Cosign keyless signatures as before.Also: the weekly matrix is gone (the official images already do Debian refreshes, and a schedule we don't watch is how this went stale), actions are on current majors (supersedes #24–#28), and the old YJIT check (
MAJOR >= 3 && MINOR >= 2) that left YJIT off for every 4.x image no longer exists.Verified locally on arm64: built 4.0.9,
RUBY_DESCRIPTIONisruby 4.0.9 (2026-10-23 revision 3e93b23afc) +PRISM, YJIT and ZJIT present,libruby.sohasBIND_NOW, env matches the official image. The pattern that hangs Ruby 4.0.5 for over a minute compiles in milliseconds. actionlint is clean.After merge: run the workflow with
4.0.9/a8057adb39f51ad6dc3106237504c93dd792bb515837b4fe7817ae21ed7e51f4(matches the ruby-lang.org post and index.txt), then point zenjoy/nimbu#2169 at it.