fix: build the image on Python 3.14

Conversation 3 Commits 2 Files Changed 2

+27 -4

2 Commits

Author	SHA1	Message	Date
hermes	c0c6b4c1fc	fix: pin the Python patch version and run the app as a non-root user Build and Push Image / Unit tests (push) Successful in 1m5s Details Build and Push Image / Build and push image (push) Skipped Details Two follow-ups to the review of the base image change. 1. Pin the patch version: `python:3.14-slim` is a floating tag, so a rebuild could silently pick up a different base image. It is now `python:3.14.10-slim`, so a rebuild is reproducible. 2. Run the app as an unprivileged user. The app only reads its own source and talks to Mongo over the network — it writes no files — so it does not need to be root. A `beer` system user is created and the image ends with `USER beer`.	2026-11-09 11:25:58 +10:00
hermes	9d3ce1d2c4	fix: build the image on Python 3.14 Build and Push Image / Unit tests (push) Successful in 1m2s Details Build and Push Image / Build and push image (push) Skipped Details The image build failed on master: ERROR: Ignored the following versions that require a different python version: 4.19.0 Requires-Python >=3.11 ERROR: Could not find a version that satisfies the requirement pymongo==4.19.0 The base image was `python:3.10` but the pinned pymongo 4.19 needs Python >= 3.11. The image is now `python:3.14-slim` — the current stable release, so it is not carrying the CVEs fixed in 3.11, 3.12 and 3.13. All the runtime dependencies ship a cp314 wheel (pymongo included), so no compiler toolchain is needed. The old apt-get line installed libsasl2-dev, python-dev-is-python3, libldap2-dev and libssl-dev for packages that are no longer in the dependency list, so it is gone and the image is smaller. The build now asserts the interpreter version, so a base image change that breaks the pinned requirements fails the build with a clear message rather than a pip resolution error.	2026-11-09 11:23:22 +10:00

Author

SHA1

Message

Date

hermes

c0c6b4c1fc

fix: pin the Python patch version and run the app as a non-root user

Build and Push Image / Unit tests (push) Successful in 1m5s

Details

Build and Push Image / Build and push image (push) Skipped

Details

Two follow-ups to the review of the base image change.

1. Pin the patch version: `python:3.14-slim` is a floating tag, so a rebuild
   could silently pick up a different base image. It is now
   `python:3.14.10-slim`, so a rebuild is reproducible.

2. Run the app as an unprivileged user. The app only reads its own source
   and talks to Mongo over the network — it writes no files — so it does not
   need to be root. A `beer` system user is created and the image ends with
   `USER beer`.

2026-11-09 11:25:58 +10:00

hermes

9d3ce1d2c4

fix: build the image on Python 3.14

Build and Push Image / Unit tests (push) Successful in 1m2s

Details

Build and Push Image / Build and push image (push) Skipped

Details

The image build failed on master:

    ERROR: Ignored the following versions that require a different python
    version: 4.19.0 Requires-Python >=3.11
    ERROR: Could not find a version that satisfies the requirement
    pymongo==4.19.0

The base image was `python:3.10` but the pinned pymongo 4.19 needs Python
>= 3.11. The image is now `python:3.14-slim` — the current stable release,
so it is not carrying the CVEs fixed in 3.11, 3.12 and 3.13.

All the runtime dependencies ship a cp314 wheel (pymongo included), so no
compiler toolchain is needed. The old apt-get line installed
libsasl2-dev, python-dev-is-python3, libldap2-dev and libssl-dev for
packages that are no longer in the dependency list, so it is gone and the
image is smaller.

The build now asserts the interpreter version, so a base image change that
breaks the pinned requirements fails the build with a clear message rather
than a pip resolution error.

2026-11-09 11:23:22 +10:00

fix: build the image on Python 3.14 #7