From 2ad0ea4d3f2320473676092e7d660f4eb5cdb99a Mon Sep 17 00:00:00 2001 From: ethernet Date: Sat, 1 Aug 2026 21:28:58 -0400 Subject: [PATCH] fix(docker): drop corepack and add libatomic1 for the Node 26 bump MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two breaks from moving node_source to node:26, both proven against the real image rather than inferred: 1. `COPY .../node_modules/corepack` failed with "not found". Node unbundled corepack upstream, so node:26 ships only `npm` in /usr/local/lib/node_modules (verified: `ls` in the pinned image lists `npm` alone). Nothing in this repo needs it — no package.json declares a `packageManager` and no build step shells out to yarn or pnpm — so the COPY and its symlink are removed rather than replaced. 2. Hidden behind that failure: node 26's binary links against `libatomic.so.1`, which node 22's did not, and bare debian:13.4 doesn't ship it. Without it every `node` invocation in the image dies with "error while loading shared libraries: libatomic.so.1". Added `libatomic1` to the existing apt layer, which runs well before the node COPY so layer ordering and caching are unchanged. Verified with a minimal probe image (debian:13.4 + the same two COPY lines): node v26.5.1, npm 11.17.0, npx 11.17.0, uv 0.11.6 all execute. --- Dockerfile | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/Dockerfile b/Dockerfile index ad52c8102753b..2de6192715ed9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -42,9 +42,9 @@ RUN apt-get -o Acquire::Retries=3 update && \ FROM ghcr.io/astral-sh/uv:0.11.6-python3.13-trixie@sha256:b3c543b6c4f23a5f2df22866bd7857e5d304b67a564f4feab6ac22044dde719b AS uv_source # Node 26 source stage. Debian trixie's bundled nodejs is pinned to 20.x -# which reached EOL in April 2026 — we copy node + npm + corepack from the -# upstream node:26 image instead (Hermes pins its toolchain to Node 26 -# everywhere). Bookworm-based slim image used so the produced binary links +# which reached EOL in April 2026 — we copy node + npm from the upstream +# node:26 image instead (Hermes pins its toolchain to Node 26 everywhere). +# Bookworm-based slim image used so the produced binary links # against glibc 2.36, which runs cleanly on our Debian 13 (trixie, glibc # 2.41) runtime. Bumping to a new Node major is a one-line ARG change; see # #4977. @@ -70,7 +70,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/opt/hermes/.playwright # hermes process, the dashboard, and per-profile gateways. RUN apt-get -o Acquire::Retries=3 update && \ apt-get -o Acquire::Retries=3 install -y --no-install-recommends \ - ca-certificates curl iputils-ping python3 python-is-python3 ripgrep ffmpeg gcc g++ make cmake python3-dev python3-venv libffi-dev libolm-dev procps git openssh-client docker-cli xz-utils && \ + ca-certificates curl iputils-ping python3 python-is-python3 ripgrep ffmpeg gcc g++ make cmake python3-dev python3-venv libffi-dev libolm-dev libatomic1 procps git openssh-client docker-cli xz-utils && \ rm -rf /var/lib/apt/lists/* # Prefer the fixed SQLite over Debian's vulnerable libsqlite3.so.0. Keep the @@ -151,17 +151,20 @@ RUN useradd -u 10000 -m -d /opt/data hermes COPY --chmod=0755 --from=uv_source /usr/local/bin/uv /usr/local/bin/uvx /usr/local/bin/ -# Node 22 LTS: copy the node binary plus the bundled npm + corepack JS -# installs from the upstream image. npm and npx are recreated as symlinks -# because they're symlinks in the source image (and need to live on PATH). +# Node 26: copy the node binary plus the bundled npm JS install from the +# upstream image. npm and npx are recreated as symlinks because they're +# symlinks in the source image (and need to live on PATH). +# +# No corepack: Node unbundled it upstream, so node:26 ships only npm in +# /usr/local/lib/node_modules. Nothing here needs it — no package.json +# declares a `packageManager`, and no build step shells out to yarn or pnpm. +# # See node_source stage at the top of the file for the version-bump # rationale (#4977). COPY --chmod=0755 --from=node_source /usr/local/bin/node /usr/local/bin/ COPY --from=node_source /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/npm -COPY --from=node_source /usr/local/lib/node_modules/corepack /usr/local/lib/node_modules/corepack RUN ln -sf /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \ - ln -sf /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx && \ - ln -sf /usr/local/lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack + ln -sf /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx WORKDIR /opt/hermes