Upgrade warp-tools base image from EOL bullseye to bookworm - #203
Conversation
Debian buster/bullseye are EOL; switch the in-house warp-tools image to python:3.10-bookworm (Debian 12), keeping Python 3.10 to minimize churn against the existing pinned packages. Also refresh the stale software LABEL to match the new image version (2.1.0).
|
Do we want to test this Docker in WARP on branch before merging? We could link WARP PR tests here. PR Tests: |
|
Testing PR in WARP |
There was a problem hiding this comment.
🟡 Changes recommended
The gzstream dependency is unpinned and the manual build script still publishes the old image version.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Upgrades the in-house warp-tools image to Debian 12 while retaining Python 3.10.
Changes:
- Switches the base image from Bullseye to Bookworm.
- Updates image metadata to version 2.1.0.
- Adjusts C++ dependency builds for newer tooling.
File summaries
| File | Description |
|---|---|
tools/Dockerfile |
Updates the base image and version label. |
tools/fastqpreprocessing/fetch_and_make_dep_libs.sh |
Updates dependency retrieval and compiler handling. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- umi-tools: base us.gcr.io/.../python:3.9-debian (EOL bullseye, now CRITICAL in trivy) -> python:3.9-bookworm; keeps py3.9 + umi_tools 1.1.1. Clears the DSP AppSec Trivy check (3rd-party-tools/umi-tools) that fails on every PR regardless of changed files. Bump umi-tools DOCKER_IMAGE_VERSION 1.0.0 -> 1.1.0 (base-OS change) per BUILDING.md. - tools/docker_build.sh: DOCKER_IMAGE_VERSION 1.0.8 -> 2.1.0 to match the Dockerfile LABEL (review comment 1). - fetch_and_make_dep_libs.sh: pin gzstream to commit 9a20658 instead of rolling master for reproducible builds (review comment 2). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
The UMI-tools image retains an unsupported Python runtime and currently fails its security scan.
Get a fresh assessment by requesting another Copilot review.
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 1
- Review effort level: Balanced
Previous commit's python:3.9-bookworm swap was wrong: the blessed base us.gcr.io/broad-dsp-gcr-public/base/python:3.9-debian is Debian 13 (trixie), not EOL bullseye. Its 3 CRITICALs are all perl and all status "fixed" (5.40.1-6+deb13u1). bookworm (Debian 12) has the same perl CVEs as fix_deferred/affected plus zlib CVE-2023-45853 will_not_fix — strictly worse. Revert to the blessed base and add `apt-get upgrade -y` so the build pulls the fixed perl, clearing all 3 CRITICALs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟢 Approval recommended
The base migration, dependency adjustments, and corresponding image versions are consistent and covered by existing build tests.
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 0 new
- Review effort level: Balanced
There was a problem hiding this comment.
🟡 Changes recommended
The unrelated UMI-tools image modification should be removed or explicitly included and validated as part of the PR scope.
Get a fresh assessment by requesting another Copilot review.
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 1
- Review effort level: Balanced
Debian buster/bullseye are EOL; switch the in-house warp-tools image to python:3.10-bookworm (Debian 12), keeping Python 3.10 to minimize churn against the existing pinned packages. Also refresh the stale software LABEL to match the new image version (2.1.0).
Upgrading umi-tools docker from a critical CVE warning.