Dockerfile: update base image to debian 13 "trixie" - #53354
Open
ctalledo wants to merge 4 commits into
Open
Conversation
Update our Dockerfile to use debian 13 as base. Some notes about architectures from the [announcement][1]; > This release for the first time officially supports the riscv64 architecture, > allowing users to run Debian on 64-bit RISC-V hardware and benefit from all > Debian 13 features. A total of seven architectures are officially supported > for trixie: > > - 64-bit PC (amd64), > - 64-bit ARM (arm64), > - ARM EABI (armel), > - ARMv7 (EABI hard-float ABI, armhf), > - 64-bit little-endian PowerPC (ppc64el), > - 64-bit little-endian RISC-V (riscv64), > - IBM System z (s390x) > > i386 is no longer supported as a regular architecture: there is no official > kernel and no Debian installer for i386 systems. The i386 architecture is > now only intended to be used on a 64-bit (amd64) CPU. Users running i386 > systems should not upgrade to trixie. Instead, Debian recommends either > reinstalling them as amd64, where possible, or retiring the hardware. > > trixie will be the last release for the armel architecture. See > [5.1.3. Last release for armel][2] in the release notes for more information > on our ARM EABI support. [1]: https://www.debian.org/News/2025/20250809 [2]: https://www.debian.org/releases/trixie/release-notes/issues.html#last-release-for-armel Signed-off-by: Sebastiaan van Stijn <[email protected]>
Signed-off-by: Albin Kerouanton <[email protected]> Signed-off-by: Sebastiaan van Stijn <[email protected]>
github-actions
Bot
added
area/networking
thaJeztah
reviewed
Aug 10, 2026
| noChainErr := "No chain/target/match by that name" | ||
| if strings.Contains(res.Combined(), "nf_tables") && versionLt(t, res.Combined(), 1, 8, 10) { | ||
| // Prior to v1.8.10, iptables-nft "-S <chain>" reports the following for a non-existent chain: | ||
| iptVerLt := versionLt(t, res.Combined(), 1, 8, 10) |
Member
There was a problem hiding this comment.
This still confused me; it checks 1.8.10 and then reports "less than 1.8.11" - I think I commented that on my PR; either the utility is incorrect, or the comment (and reference to the version in which the change was)
Collaborator
Author
There was a problem hiding this comment.
Agree, fixed. Thanks!
ctalledo
force-pushed
the
trixie_me_trixie_you
branch
from
August 10, 2026 20:56
59a6a3a to
7f822ec
Compare
Debian 13 ships iptables-nft v1.8.11 which returns a different error when `iptables -S` a nonexistent chain than previous versions. Older versions: ip6tables v1.8.9 (nf_tables): chain `<chain>' in table `filter' is incompatible, use 'nft' tool. Newer versions: ip6tables: No chain/target/match by that name. Signed-off-by: Albin Kerouanton <[email protected]> Signed-off-by: Sebastiaan van Stijn <[email protected]> Signed-off-by: Cesar Talledo <[email protected]>
ctalledo
force-pushed
the
trixie_me_trixie_you
branch
from
August 10, 2026 21:33
7f822ec to
ab13d01
Compare
During firewalld reload, the OnReloaded callback calls setupIPChains, which uses EnsureJumpRule (delete-then-reinsert) to reposition jump rules at the top of each chain. With trixie's newer firewalld, a race can occur where firewalld's background cleanup removes DOCKER-INTERNAL between the delete of the jump rule and the reinsert, causing the reinsert to fail with "Chain 'DOCKER-INTERNAL' does not exist". The error triggers setupIPChains cleanup defers, which delete all Docker chains and leave the daemon unable to create internal networks. Fix by calling removeIPChains before setupIPChains in the OnReloaded callback, mirroring what NewIptabler already does. With a clean slate, EnsureJumpRule skips the delete step and inserts into freshly-created chains, eliminating the race window. Signed-off-by: Cesar Talledo <[email protected]>
ctalledo
force-pushed
the
trixie_me_trixie_you
branch
from
August 11, 2026 04:12
f2473e8 to
2d2945c
Compare
Member
|
Couple of failures seem to persist (but not 100% sure); they seem networking related, so could be related; https://github.com/moby/moby/actions/runs/31457736782/job/93769194277?pr=53354 === Failed
=== FAIL: amd64.usr.src.moby.integration.network.bridge TestLegacyLink/no_link (0.19s)
bridge_linux_test.go:712: assertion failed: string "Connecting to 172.18.0.2 (172.18.0.2:80)\nwget: server returned error: HTTP/1.0 404 Not Found\n" does not contain "download timed out"
--- FAIL: TestLegacyLink/no_link (0.19s)
=== FAIL: amd64.usr.src.moby.integration.network.bridge TestLegacyLink (3.64s)=== Failed
=== FAIL: amd64.usr.src.moby.integration.networking TestBridgeICC/IPv6_ULA_on_non-internal_network (17.94s)
firewall.go:69: Firewalld reload completed at 2026-08-11T12:09:18Z
bridge_linux_test.go:220: timeout hit after 15s: ping failed with exit code 1, stdout: PING ctr-icc-2-1 (fdf1:a844:380c:b200::2): 56 data bytes
--- ctr-icc-2-1 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
, stderr:
--- FAIL: TestBridgeICC/IPv6_ULA_on_non-internal_network (17.94s)
=== FAIL: amd64.usr.src.moby.integration.networking TestBridgeICC/IPv6_ULA_on_internal_network (17.41s)
firewall.go:69: Firewalld reload completed at 2026-08-11T12:09:36Z
bridge_linux_test.go:220: timeout hit after 15s: ping failed with exit code 1, stdout: PING ctr-icc-3-1 (fdf1:a844:380c:b247::2): 56 data bytes
--- ctr-icc-3-1 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
, stderr:
--- FAIL: TestBridgeICC/IPv6_ULA_on_internal_network (17.41s)
=== FAIL: amd64.usr.src.moby.integration.networking TestBridgeICC/IPv6_link-local_address_on_non-internal_network (18.10s)
firewall.go:69: Firewalld reload completed at 2026-08-11T12:09:54Z
bridge_linux_test.go:220: timeout hit after 15s: ping failed with exit code 1, stdout: PING fe80::2%eth0 (fe80::2): 56 data bytes
--- fe80::2%eth0 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
, stderr:
--- FAIL: TestBridgeICC/IPv6_link-local_address_on_non-internal_network (18.10s)
=== FAIL: amd64.usr.src.moby.integration.networking TestBridgeICC/IPv6_link-local_address_on_internal_network (17.54s)
firewall.go:69: Firewalld reload completed at 2026-08-11T12:10:12Z
bridge_linux_test.go:220: timeout hit after 15s: ping failed with exit code 1, stdout: PING fe80::2%eth0 (fe80::2): 56 data bytes
--- fe80::2%eth0 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
, stderr:
--- FAIL: TestBridgeICC/IPv6_link-local_address_on_internal_network (17.54s)
=== FAIL: amd64.usr.src.moby.integration.networking TestBridgeICC/IPv6_non-internal_network_with_SLAAC_LL_address (18.04s)
firewall.go:69: Firewalld reload completed at 2026-08-11T12:10:36Z
bridge_linux_test.go:220: timeout hit after 15s: ping failed with exit code 1, stdout: PING fe80::42:acff:fe11:2%eth0 (fe80::42:acff:fe11:2): 56 data bytes
--- fe80::42:acff:fe11:2%eth0 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
, stderr:
--- FAIL: TestBridgeICC/IPv6_non-internal_network_with_SLAAC_LL_address (18.04s)
=== FAIL: amd64.usr.src.moby.integration.networking TestBridgeICC/IPv6_internal_network_with_SLAAC_LL_address (17.97s)
firewall.go:69: Firewalld reload completed at 2026-08-11T12:10:54Z
bridge_linux_test.go:220: timeout hit after 15s: ping failed with exit code 1, stdout: PING fe80::42:acff:fe11:2%eth0 (fe80::42:acff:fe11:2): 56 data bytes
--- fe80::42:acff:fe11:2%eth0 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
, stderr:
--- FAIL: TestBridgeICC/IPv6_internal_network_with_SLAAC_LL_address (17.97s)
=== FAIL: amd64.usr.src.moby.integration.networking TestBridgeICC (120.11s)
=== FAIL: amd64.usr.src.moby.integration.networking TestAccessToPublishedPort/client=nat/proxy=false/ipv6 (3.26s)
bridge_linux_test.go:623: assertion failed: string "Connecting to [fd46:81d2:91d6::1]:8080 ([fd46:81d2:91d6::1]:8080)\nwget: download timed out\n" does not contain "404 Not Found": url: http://[fd46:81d2:91d6::1]:8080
--- FAIL: TestAccessToPublishedPort/client=nat/proxy=false/ipv6 (3.26s)
=== FAIL: amd64.usr.src.moby.integration.networking TestAccessToPublishedPort/client=nat/proxy=false (8.35s)
firewall.go:69: Firewalld reload completed at 2026-08-11T12:12:16Z
--- FAIL: TestAccessToPublishedPort/client=nat/proxy=false (8.35s)
=== FAIL: amd64.usr.src.moby.integration.networking TestAccessToPublishedPort (24.29s)=== Failed
=== FAIL: amd64.usr.src.moby.integration.service TestRestoreIngressRulesOnFirewalldReload (42.06s)
network_linux_test.go:326: Waiting for the service to start
network_linux_test.go:328: Checking http access to the service
network_linux_test.go:329: timeout hit after 30s: first check never completed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebased from #50726 (originally by @thaJeztah). All test fixes that were blocking the original PR have since landed in master via separate PRs — see comment on #50726 for details.
- What I did
Updated the Dockerfile to use debian 13 "trixie" as the base image, and installed
e2fsprogsto fix a missingmkfs.ext4. Also includes fixes fornftablesdoc(dstnat priority format changed in trixie) andTestUserChain(iptables error message format changed in trixie v1.8.11).- How I did it
Rebase of #50726 onto current master, squashed to 3 logical commits.
- How to verify it
Run CI.
- Human readable description for the release notes
Created with: Claude Sonnet 4.6