Upgrade containers to Alpine 3.20

Author: charmander

.github/workflows/tests.yml

@@ -9,7 +9,7 @@ jobs:
       contents: read
 
     container:
-      image: ghcr.io/weasyl/ci-base-image@sha256:9a366824361bf3123b28364ab6a4bd039ac765fafd5a1baab07f5c7c4485c007
+      image: ghcr.io/weasyl/ci-base-image@sha256:960e621bcdde15bdf9b1dd29c8b45dec93927aa67f2e7f4ab3f763a16f2b99f4
       options: --user 1001
 
     services:
@@ -61,6 +61,7 @@ jobs:
         run: |
           cp ci/site.config.txt config/
           cp config/weasyl-staff.example.py config/weasyl-staff.py
+          cat imagemagick-policy.xml > /usr/etc/ImageMagick-6/policy.xml
           printf %.8s "$GITHUB_SHA" > version.txt
 
       - name: Build assets

Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1
-FROM docker.io/library/node:16-alpine3.16 AS asset-builder
+FROM docker.io/library/node:18-alpine3.20 AS asset-builder
 RUN --mount=type=cache,id=apk,target=/var/cache/apk,sharing=locked \
     ln -s /var/cache/apk /etc/apk/cache && apk upgrade && apk add \
     sassc runit
@@ -16,7 +16,7 @@ COPY assets assets
 RUN node build.js
 
 
-FROM docker.io/library/alpine:3.16 AS mozjpeg
+FROM docker.io/library/alpine:3.20 AS mozjpeg
 RUN --mount=type=cache,id=apk,target=/var/cache/apk,sharing=locked \
     ln -s /var/cache/apk /etc/apk/cache && apk upgrade && apk add \
     musl-dev gcc make \
@@ -88,7 +88,7 @@ RUN --network=none make -j"$(nproc)"
 RUN --network=none make install DESTDIR="$HOME/package-root"
 
 
-FROM docker.io/library/python:3.10-alpine3.16 AS bdist
+FROM docker.io/library/python:3.10-alpine3.20 AS bdist
 # libwebp-dev, zlib-dev: Pillow
 # libffi-dev, openssl-dev: cryptography
 # libmemcached-dev: pylibmc
@@ -138,15 +138,14 @@ RUN --mount=type=cache,id=poetry,target=/weasyl/.cache/pypoetry,sharing=locked,u
     .poetry-venv/bin/poetry install --only=dev
 
 
-FROM docker.io/library/python:3.10-alpine3.16 AS package
-# gcc (libgomp), lcms2, libpng, libxml2, libwebp: ImageMagick
+FROM docker.io/library/python:3.10-alpine3.20 AS package
+# gcc (libgomp), lcms2, libpng, libxml2, libwebp*: ImageMagick
 RUN --mount=type=cache,id=apk,target=/var/cache/apk,sharing=locked \
     ln -s /var/cache/apk /etc/apk/cache && apk upgrade && apk add \
-    gcc lcms2 libpng libxml2 libwebp \
+    gcc lcms2 libpng libxml2 libwebpdemux libwebpmux \
     libffi \
     libmemcached-libs \
     libpq \
-    libwebp \
     libxslt
 RUN adduser -S weasyl -h /weasyl
 WORKDIR /weasyl
@@ -175,7 +174,7 @@ COPY assets assets
 CMD pytest -x libweasyl.test libweasyl.models.test && pytest -x weasyl.test
 STOPSIGNAL SIGINT
 
-FROM docker.io/library/alpine:3.16 AS flake8
+FROM docker.io/library/alpine:3.20 AS flake8
 RUN --mount=type=cache,id=apk,target=/var/cache/apk,sharing=locked \
     ln -s /var/cache/apk /etc/apk/cache && apk upgrade && apk add \
     py3-flake8

containers/postgres/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/library/postgres:13-alpine3.16
+FROM docker.io/library/postgres:13-alpine3.20
 COPY \
     00-hstore.sql \
     01-test.sql \

docker-compose.yml

@@ -79,7 +79,7 @@ services:
     read_only: false
 
   memcached:
-    image: docker.io/library/memcached:1.6-alpine3.16
+    image: docker.io/library/memcached:1.6-alpine3.20
     command: --memory-limit=64
     networks:
       - web-memcached
@@ -117,7 +117,7 @@ services:
 
   configure:
     profiles: [ configure ]
-    image: docker.io/library/alpine:3.16
+    image: docker.io/library/alpine:3.20
     entrypoint:
       - sh
       - -c

tools/poetry-requirements/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/library/python:3.10-alpine3.16
+FROM docker.io/library/python:3.10-alpine3.20
 RUN python3 -m venv .poetry-venv && .poetry-venv/bin/pip install poetry
 RUN .poetry-venv/bin/poetry self add poetry-plugin-export
 COPY pyproject.toml ./