From e6bf7a03fef8a9f2e4802d63afdafb40627c7ad9 Mon Sep 17 00:00:00 2001
From: pratikbin <68642400+pratikbin@users.noreply.github.com>
Date: Thu, 28 May 2026 13:01:45 +0530
Subject: [PATCH 1/2] fix(docker): upgrade base images to Python 3.13 /
 debian13
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- python:3.11-slim → python:3.13-slim (builder + runtime-slim-base)
- distroless/python3-debian13 already debian13; was mismatched against
  Python 3.11 build stage causing ModuleNotFoundError on pydantic_core
  _pydantic_core.cpython-311 .so in Python 3.13 runtime
- uv 0.6.17 → 0.11.16
- Refresh pinned digests for both base images (2026-05-28)

Affected tags: slim, slim-nonroot, code-slim, code-slim-nonroot
PyO3 0.22.6 (in Cargo.lock) supports Python 3.13.
---
 Dockerfile | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 9ed5233d2..755a32a2d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,9 +1,9 @@
-ARG PYTHON_VERSION=3.11
-ARG UV_VERSION=0.6.17
-# Pinned 2026-04-15. Update via Dependabot or: docker pull python:3.11-slim
-ARG PYTHON_DIGEST=sha256:233de06753d30d120b1a3ce359d8d3be8bda78524cd8f520c99883bfe33964cf
-# Pinned 2026-04-15. Update via Dependabot or: docker pull gcr.io/distroless/python3-debian13
-ARG DISTROLESS_DIGEST=sha256:ed3a4beb46f8f8baac068743ba1b1f95ea3f793422129cf6dd23967f779b6018
+ARG PYTHON_VERSION=3.13
+ARG UV_VERSION=0.11.16
+# Pinned 2026-05-28. Update via Dependabot or: docker pull python:3.13-slim
+ARG PYTHON_DIGEST=sha256:b04b5d7233d2ad9c379e22ea8927cd1378cd15c60d4ef876c065b25ea8fb3bf3
+# Pinned 2026-05-28. Update via Dependabot or: docker pull gcr.io/distroless/python3-debian13
+ARG DISTROLESS_DIGEST=sha256:a156791331382d183a569c1714a6c5364d5402e622da5618005308c2adcb4a9c
 ARG DISTROLESS_IMAGE=gcr.io/distroless/python3-debian13
 ARG PYTHON_SITE_PACKAGES=/usr/local/lib/python${PYTHON_VERSION}/site-packages
 

From 0be2fcb652009b8af1af10bba4bcd763b9dcaa94 Mon Sep 17 00:00:00 2001
From: pratikbin <68642400+pratikbin@users.noreply.github.com>
Date: Thu, 28 May 2026 15:12:11 +0530
Subject: [PATCH 2/2] chore(docker): remove pinned digests, use floating tags

Digest pinning provided reproducibility at the cost of manual upkeep.
Switching to floating tags (python:3.13-slim, distroless/python3-debian13)
lets Dependabot / CI always pull the latest patched image.
---
 Dockerfile | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 755a32a2d..315fa86d4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,14 +1,10 @@
 ARG PYTHON_VERSION=3.13
 ARG UV_VERSION=0.11.16
-# Pinned 2026-05-28. Update via Dependabot or: docker pull python:3.13-slim
-ARG PYTHON_DIGEST=sha256:b04b5d7233d2ad9c379e22ea8927cd1378cd15c60d4ef876c065b25ea8fb3bf3
-# Pinned 2026-05-28. Update via Dependabot or: docker pull gcr.io/distroless/python3-debian13
-ARG DISTROLESS_DIGEST=sha256:a156791331382d183a569c1714a6c5364d5402e622da5618005308c2adcb4a9c
 ARG DISTROLESS_IMAGE=gcr.io/distroless/python3-debian13
 ARG PYTHON_SITE_PACKAGES=/usr/local/lib/python${PYTHON_VERSION}/site-packages
 
 # ---- Build stage: compile native extensions, build wheel ----
-FROM python:${PYTHON_VERSION}-slim@${PYTHON_DIGEST} AS builder
+FROM python:${PYTHON_VERSION}-slim AS builder
 
 ARG UV_VERSION
 
@@ -65,7 +61,7 @@ RUN cd /tmp && python -c "from headroom._core import DiffCompressor, SmartCrushe
     print(f'build-stage rust core verify OK: {DiffCompressor.__name__}, {SmartCrusher.__name__}')"
 
 # ---- Runtime stage (python-slim): supports root/nonroot via build arg ----
-FROM python:${PYTHON_VERSION}-slim@${PYTHON_DIGEST} AS runtime-slim-base
+FROM python:${PYTHON_VERSION}-slim AS runtime-slim-base
 
 ARG RUNTIME_USER=nonroot
 ARG PYTHON_SITE_PACKAGES
@@ -102,7 +98,7 @@ HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
 ENTRYPOINT ["headroom", "proxy"]
 CMD ["--host", "0.0.0.0", "--port", "8787"]
 
-FROM ${DISTROLESS_IMAGE}@${DISTROLESS_DIGEST} AS runtime-slim
+FROM ${DISTROLESS_IMAGE} AS runtime-slim
 
 ARG RUNTIME_USER=nonroot
 ARG PYTHON_SITE_PACKAGES