Greetings

I was reviewing the security vulnerabilities of my production images, specifically the difference between the latest default Dockerfile configuration generated with mix phx.gen.release --docker, bullseye-20240423-slim

image1132×195 19.1 KB

and Ubuntu’s recently released 24.04 LTS version, Noble Numbat, noble-20240423

image1132×153 13.9 KB

Issue

Unfortunately the hexpm/elixir registry only has a few versions of elixir built with erlang 25.2.3 about 3 days ago, and only for arm64/v8.

image1179×722 51.7 KB

Question

Is the service that creates these images set to build and release them slowly on purpose, or is there some issue with it?

The relevant OTP images do exist in builds.hex.pm/builds/otp/ubuntu-24.04/builds.txt

...
OTP-26.2.3 928d03e6da416208fce7b9a7dbbfbb4f25d26c37 2024-04-25T22:38:03Z
OTP-26.2.4 e26c5206dc98ec1b8f978fceaa61fd1354266ccb 2024-04-25T22:24:21Z
...

Temp fix

What I’m doing in the meantime is just building with the previous beta version of noble, and then copy and run the app with the official bare noble image

 ARG ELIXIR_VERSION=1.16.2
 ARG OTP_VERSION=26.2.4
 ARG DISTRO_NAME=ubuntu
 ARG BUILD_IMAGE_VERSION=noble-20240225
 ARG RELEASE_IMAGE_VERSION=noble-20240423

 ARG BUILDER_IMAGE="hexpm/elixir:${ELIXIR_VERSION}-erlang-${OTP_VERSION}-${DISTRO_NAME}-${BUILD_IMAGE_VERSION}"
 ARG RUNNER_IMAGE="${DISTRO_NAME}:${RELEASE_IMAGE_VERSION}"