🧱 QD-13151 Switch to DHI images

Author: tiulpin

.devcontainer/Dockerfile

@@ -15,18 +15,17 @@
 #
 # This Dockerfile is for https://github.com/jetbrains/qodana-cli dev container.
 
-FROM golang:bookworm
+FROM dhi.io/golang:1.25-debian13-dev
 ARG TARGETARCH
 ARG CLANG=16
 ENV TARGETARCH=$TARGETARCH \
     CLANG=$CLANG
 ENV CHOCO_VERSION=2.2.2 \
     GH_VERSION=2.41.0
-ENV MONO_REPO="https://download.mono-project.com/repo/debian" \
-    MONO_KEY="3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF"
+ENV MONO_REPO="https://download.mono-project.com/repo/debian"
 
-RUN set -ex &&  \
-    apt-get update && apt-get install -y --no-install-recommends \
+RUN set -ex && ln -s /usr/bin/which.debianutils /usr/bin/which && \
+    apt-get update && apt-get install -y --no-install-recommends init-system-helpers gzip wget \
       apt-transport-https \
       autoconf \
       automake \
@@ -40,16 +39,16 @@ RUN set -ex &&  \
       make \
       patch \
       libc6-dev \
+      libicu76 \
       git \
       git-lfs \
       default-jre \
       xdg-utils
 
 # note: choco is required for the full goreleaser functionality
 RUN set -ex &&  \
-    mkdir -p /tmp /opt/chocolatey &&  \
-    gpg --homedir /tmp --no-default-keyring --keyring /usr/share/keyrings/mono-official-archive-keyring.gpg  \
-        --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys $MONO_KEY &&  \
+    mkdir -p /tmp /opt/chocolatey /usr/local/bin &&  \
+    curl -fsSL https://download.mono-project.com/repo/xamarin.gpg | gpg --dearmor > /usr/share/keyrings/mono-official-archive-keyring.gpg &&  \
     echo "deb [trusted=yes] https://repo.goreleaser.com/apt/ /" | tee /etc/apt/sources.list.d/goreleaser.list &&  \
     echo "deb [signed-by=/usr/share/keyrings/mono-official-archive-keyring.gpg] $MONO_REPO stable-buster main" |  \
         tee /etc/apt/sources.list.d/mono-official-stable.list &&  \

.github/workflows/base.yml

@@ -20,7 +20,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        group: ["default", "more", "clang", "ruby"]
+        group:
+          - jvm        # jvm-community → jvm → python-community → python
+          - dotnet     # dotnet-community → dotnet
+          - clang      # clang 20, 21 (Trixie)
+          - clang-16   # clang 16 (Bookworm)
+          - clang-17   # clang 17 (Bookworm)
+          - clang-18   # clang 18 (Bookworm)
+          - clang-19   # clang 19 (Bookworm)
+          - go         # standalone
+          - js         # standalone
+          - php        # standalone
+          - rust       # standalone
+          - ruby       # ruby 3.2, 3.3, 3.4
     runs-on: ubuntu-latest
     steps:
       - name: Clean up
@@ -40,6 +52,11 @@ jobs:
           registry: registry.jetbrains.team
           username: ${{ secrets.SPACE_USERNAME }}
           password: ${{ secrets.SPACE_PASSWORD }}
+      - uses: docker/login-action@v3
+        with:
+          registry: dhi.io
+          username: ${{ secrets.DHI_USERNAME }}
+          password: ${{ secrets.DHI_PASSWORD }}
       - name: Build and push
         uses: docker/bake-action@v6
         with:

.github/workflows/devcontainer.yml

@@ -34,6 +34,11 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/login-action@v3
+        with:
+          registry: dhi.io
+          username: ${{ secrets.DHI_USERNAME }}
+          password: ${{ secrets.DHI_PASSWORD }}
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
       - uses: docker/build-push-action@v6

.github/workflows/docker-ci.yml

@@ -47,6 +47,11 @@ jobs:
         uses: actions/checkout@v6
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: dhi.io
+          username: ${{ secrets.DHI_USERNAME }}
+          password: ${{ secrets.DHI_PASSWORD }}
       - name: Build
         uses: docker/build-push-action@v6
         with:

dockerfiles/base/cpp-community-bookworm.Dockerfile

@@ -0,0 +1,67 @@
+FROM debian:bookworm-slim
+ARG CLANG="18"
+
+ENV HOME="/root" \
+    LC_ALL="en_US.UTF-8" \
+    QODANA_DIST="/opt/idea" \
+    QODANA_DATA="/data" \
+    QODANA_DOCKER="true"
+
+ENV JAVA_HOME="$QODANA_DIST/jbr" \
+    QODANA_CONF="$HOME/.config/idea" \
+    PATH="/opt/qodana:$QODANA_DIST/bin:${PATH}"
+
+ENV CXX="/usr/lib/llvm-$CLANG/bin/clang++" \
+    CC="/usr/lib/llvm-$CLANG/bin/clang" \
+    CPLUS_INCLUDE_PATH="/usr/lib/clang/$CLANG/include"
+
+# hadolint ignore=SC2174,DL3009
+RUN --mount=target=/var/lib/apt/lists,type=cache,sharing=locked \
+    --mount=target=/var/cache/apt,type=cache,sharing=locked \
+    rm -f /etc/apt/apt.conf.d/docker-clean && \
+    mkdir -m 777 -p /opt/qodana $QODANA_DATA/project $QODANA_DATA/cache $QODANA_DATA/results && apt-get update && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        default-jre \
+        gawk \
+        git \
+        git-lfs \
+        gnupg2 \
+        apt-transport-https \
+        autoconf \
+        automake \
+        cmake \
+        dpkg-dev \
+        file \
+        make \
+        patch \
+        libc6-dev \
+        locales && \
+    echo 'en_US.UTF-8 UTF-8' > /etc/locale.gen && locale-gen && \
+    apt-get autoremove -y && apt-get clean && \
+    chmod 777 -R $HOME && \
+    echo 'root:x:0:0:root:/root:/bin/bash' > /etc/passwd && chmod 666 /etc/passwd && \
+    git config --global --add safe.directory '*'
+
+RUN echo "deb https://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-${CLANG} main" > /etc/apt/sources.list.d/llvm.list && \
+    curl -s https://apt.llvm.org/llvm-snapshot.gpg.key | gpg --dearmor > /etc/apt/trusted.gpg.d/llvm.gpg && \
+    apt-key adv --keyserver keyserver.ubuntu.com --recv-keys "15CF4D18AF4F7421" && \
+    apt-get -qq update && \
+    apt-get install -qqy -t \
+      llvm-toolchain-bookworm-$CLANG \
+      clang-$CLANG \
+      clang-tidy-$CLANG \
+      clang-format-$CLANG \
+      lld-$CLANG \
+      libc++-$CLANG-dev \
+      libc++abi-$CLANG-dev && \
+    for f in /usr/lib/llvm-$CLANG/bin/*; do ln -sf "$f" /usr/bin; done && \
+    ln -sf clang /usr/bin/cc && \
+    ln -sf clang /usr/bin/c89 && \
+    ln -sf clang /usr/bin/c99 && \
+    ln -sf clang++ /usr/bin/c++ && \
+    ln -sf clang++ /usr/bin/g++ && \
+    rm -rf /var/lib/apt/lists/* && \
+    apt-get autoremove -y && apt-get clean
+

dockerfiles/base/cpp-community.Dockerfile

@@ -1,6 +1,6 @@
-ARG BASE_TAG="bookworm-slim"
-FROM debian:$BASE_TAG
-ARG CLANG="16"
+ARG BASE_TAG="trixie"
+FROM dhi.io/debian-base:$BASE_TAG
+ARG CLANG="20"
 
 ENV HOME="/root" \
     LC_ALL="en_US.UTF-8" \
@@ -25,6 +25,7 @@ RUN --mount=target=/var/lib/apt/lists,type=cache,sharing=locked \
         ca-certificates \
         curl \
         default-jre \
+        gawk \
         git \
         git-lfs \
         gnupg2 \
@@ -44,12 +45,11 @@ RUN --mount=target=/var/lib/apt/lists,type=cache,sharing=locked \
     echo 'root:x:0:0:root:/root:/bin/bash' > /etc/passwd && chmod 666 /etc/passwd && \
     git config --global --add safe.directory '*'
 
-RUN echo "deb https://apt.llvm.org/bookworm/ llvm-toolchain-bookworm-${CLANG} main" > /etc/apt/sources.list.d/llvm.list && \
+RUN echo "deb https://apt.llvm.org/trixie/ llvm-toolchain-trixie-${CLANG} main" > /etc/apt/sources.list.d/llvm.list && \
     curl -s https://apt.llvm.org/llvm-snapshot.gpg.key | gpg --dearmor > /etc/apt/trusted.gpg.d/llvm.gpg && \
-    apt-key adv --keyserver keyserver.ubuntu.com --recv-keys "15CF4D18AF4F7421" && \
     apt-get -qq update && \
     apt-get install -qqy -t \
-      llvm-toolchain-bookworm-$CLANG \
+      llvm-toolchain-trixie-$CLANG \
       clang-$CLANG \
       clang-tidy-$CLANG \
       clang-format-$CLANG \

dockerfiles/base/cpp.Dockerfile

@@ -1,26 +1,26 @@
-ARG BASE_TAG="bookworm-slim"
-ARG NODE_TAG="22-bookworm-slim"
-FROM node:$NODE_TAG AS node_base
+ARG BASE_TAG="trixie"
+ARG NODE_TAG="22-debian13-dev"
+FROM dhi.io/node:$NODE_TAG AS node_base
 FROM cpp-community
 
 # renovate: datasource=npm depName=eslint
 ENV ESLINT_VERSION="9.31.0"
-# renovate: datasource=npm depName=pnpm
-ENV PNPM_VERSION="10.13.1"
 
 ENV PATH="/opt/yarn/bin:$PATH"
 ENV SKIP_YARN_COREPACK_CHECK=0
-COPY --from=node_base /usr/local/bin/node /usr/local/bin/
-COPY --from=node_base /usr/local/include/node /usr/local/include/node
-COPY --from=node_base /usr/local/lib/node_modules /usr/local/lib/node_modules
-COPY --from=node_base /opt/yarn-* /opt/yarn/
+COPY --from=node_base /opt/nodejs/node-*/bin/node /usr/local/bin/
+COPY --from=node_base /opt/nodejs/node-*/include/node /usr/local/include/node
+COPY --from=node_base /opt/nodejs/node-*/lib/node_modules /usr/local/lib/node_modules
+COPY --from=node_base /opt/yarn/ /opt/yarn/
 RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm && \
     ln -s /usr/local/lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx && \
     ln -s /usr/local/lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack && \
+    mkdir -p /opt/yarn/bin && ln -s /opt/yarn/yarn-*/bin/yarn /opt/yarn/bin/ && \
+    ln -s /opt/yarn/yarn-*/bin/yarnpkg /opt/yarn/bin/ && \
     node --version && \
     npm --version && \
     yarn --version && \
-    npm install -g eslint@$ESLINT_VERSION pnpm@$PNPM_VERSION && npm config set update-notifier false && \
+    npm install -g eslint@$ESLINT_VERSION && npm config set update-notifier false && \
     chmod 777 -R "$HOME/.npm" "$HOME/.npmrc" && \
     apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \