Skip to content

SOLR-17353 Bump gosu binary to v1.19 in docker images #4273

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
janhoy wants to merge 3 commits into
base: main
Choose a base branch
from
+40 −7
Open

SOLR-17353 Bump gosu binary to v1.19 in docker images #4273

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
29cb617
SOLR-17353 Bump gosu binary to v1.19 in docker images
janhoy Apr 9, 2026
05b280e
Update changelog with proper type
janhoy Apr 9, 2026
e996fa8
Apply stricter chmod on GNUPGHOME
janhoy Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions .github/renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,19 @@
"enabled": true,
"gitIgnoredAuthors": ["renovate-bot <renovate-bot@noreply.github.com>"],
"dependencyDashboard": false,
"enabledManagers": ["gradle", "github-actions"],
"enabledManagers": ["gradle", "github-actions", "regex"],
"labels": ["exempt-stale"],
"includePaths": ["gradle/libs.versions.toml", "versions.*", "build.gradle", ".github/workflows/*"],
"includePaths": ["gradle/libs.versions.toml", "versions.*", "build.gradle", ".github/workflows/*", "solr/docker/templates/Dockerfile.body.template"],
"customManagers": [
{
"description": "Track gosu GitHub releases and update ARG GOSU_VERSION in Dockerfile template",
"customType": "regex",
"fileMatch": ["^solr/docker/templates/Dockerfile\\.body\\.template$"],
"matchStrings": ["ARG GOSU_VERSION=(?<currentValue>[^\\s]+)"],
"depNameTemplate": "tianon/gosu",
"datasourceTemplate": "github-releases"
Copy link
Copy Markdown
Contributor Author

@janhoy janhoy Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not tested, a bit hard to dry-run these things, but is an attractive way to monitor version of a binary that would else fall between the cracks. The snippet is created by AI and I ran it through another AI to validate syntax. I suggest we do manual review and then test that it actaully works "live" post merge.

Copy link
Copy Markdown
Contributor

@malliaridis malliaridis Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to our friend claude, this can be simplified by adding the below comment above the ARG in the dockerfile:

# renovate: datasource=github-releases depName=tianon/gosu
ARG GOSU_VERSION=1.19

Then you only have to include the below configuration to include the custom file in the scans:

{
  ...
  "dockerfile": {
    "fileMatch": ["(^|/)Dockerfile\\.body\\.template$"]
  }
}

Copy link
Copy Markdown
Contributor

@malliaridis malliaridis Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also believe there is a simple way for running renovate on local repository through the local platform feature. I will see if I can prepare something for testing purposes and see if my above proposal works as expected. :)

Copy link
Copy Markdown
Contributor

@malliaridis malliaridis Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I could confirm your solution with the following command (renovate was installed via npm install -g renovate):

LOG_LEVEL=debug RENOVATE_LOG_FORMAT=json npx renovate --platform local --dry-run=lookup 2>&1 > report.log

I downgraded to 1.17 to see if renovate picks it up, and the output confirmed it:

{"depName":"tianon/gosu","currentValue":"1.17","datasource":"github-releases","replaceString":"# renovate: datasource=github-releases depName=tianon/gosu\nARG GOSU_VERSION=1.17","updates":[{"bucket":"non-major","newVersion":"1.19","newValue":"1.19","releaseTimestamp":"2025-09-23T19:10:36.000Z","newVersionAgeInDays":198,"newMajor":1,"newMinor":19,"newPatch":0,"updateType":"minor","libYears":1.890115138254693,"branchName":"renovate/tianon-gosu-1.x"}],"packageName":"tianon/gosu","versioning":"semver-coerced","warnings":[],"sourceUrl":"https://github.com/tianon/gosu","registryUrl":"https://github.com","currentVersion":"1.17","currentVersionTimestamp":"2023-11-02T21:46:05.000Z","currentVersionAgeInDays":889,"isSingleVersion":true,"fixedVersion":"1.17"}

The solution with the comment can still be used though, so that we can generalize the matching to other packages as well (more future-proof). This can be done by changing the matchStrings with

"matchStrings": [
  "# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>[^\\s]+)\\nARG \\w+_VERSION=(?<currentValue>[^\\s]+)"
],

and add this comment above the ARG:

# renovate: datasource=github-releases depName=tianon/gosu
ARG GOSU_VERSION=1.19

renovate will then pick the datasource and depName from the comment, rather than the renovate.json file (more flexible).

}
],
"postUpgradeTasks": {
"commands": [
"./gradlew resolveAndLockAll --write-locks",
Expand Down
8 changes: 8 additions & 0 deletions changelog/unreleased/SOLR-17353-docker-gosu-upgrade.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
title: Bump gosu binary to v1.19 in docker images
type: dependency_update
authors:
- name: Jan Høydahl
url: https://home.apache.org/phonebook.html?uid=janhoy
links:
- name: SOLR-17353
url: https://issues.apache.org/jira/browse/SOLR-17353
25 changes: 20 additions & 5 deletions solr/docker/templates/Dockerfile.body.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,26 @@ ENV SOLR_USER="solr" \
SOLR_HOST_BIND="0.0.0.0" \
SOLR_ZOOKEEPER_EMBEDDED_HOST="0.0.0.0"

ARG GOSU_VERSION=1.19
Copy link
Copy Markdown
Contributor Author

@janhoy janhoy Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/tianon/gosu/releases/tag/1.19

RUN set -eux; \
apt-get update; \
apt-get -y --no-install-recommends install curl acl lsof procps wget netcat-openbsd tini jattach gpg gnupg dirmngr; \
rm -rf /var/lib/apt/lists/*; \
dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${dpkgArch}"; \
wget -O /tmp/gosu.asc "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${dpkgArch}.asc"; \
export GNUPGHOME="$(mktemp -d)"; \
chmod 700 "$GNUPGHOME"; \
gpg --batch --keyserver hkps://keys.openpgp.org \
--recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
gpg --batch --verify /tmp/gosu.asc /usr/local/bin/gosu; \
gpgconf --kill gpg-agent; \
rm -rf "$GNUPGHOME" /tmp/gosu.asc; \
chmod +x /usr/local/bin/gosu; \
gosu --version; \
gosu nobody true; \
apt-get -y remove gpg dirmngr && apt-get -y autoremove

RUN set -ex; \
groupadd -r --gid "$SOLR_GID" "$SOLR_GROUP"; \
useradd -r --uid "$SOLR_UID" --gid "$SOLR_GID" "$SOLR_USER"
Expand All @@ -67,11 +87,6 @@ RUN set -ex; \
mkdir -p -m0770 /var/solr; \
chown -R "$SOLR_USER:0" /var/solr;

RUN set -ex; \
apt-get update; \
apt-get -y --no-install-recommends install curl acl lsof procps wget netcat-openbsd gosu tini jattach; \
rm -rf /var/lib/apt/lists/*;

VOLUME /var/solr
EXPOSE 8983
WORKDIR /opt/solr
Expand Down
Loading