Move to Debian Bookworm + refresh compiler matrix + isolate v2.6 (cgroupv2)#29
Open
Harishkrishna17 wants to merge 4 commits into
Open
Conversation
… versions Re-baseline the Talview Judge0 compilers image: - Base: judge0/buildpack-deps:buster-2019-12-28 -> buildpack-deps:bookworm Buster reached EOL 2024-06; Bookworm ships glibc 2.36 + gcc-12, which are sufficient hosts for every modern toolchain installed below. - Drop the archive.debian.org sources.list workaround (no longer needed on a maintained base). Compiler bumps (latest stable): GCC 7.4.0/8.3.0/9.2.0 -> 14.2.0 Ruby 2.7.0 -> 3.3.7 Python 2.7.17/3.8.1 -> 3.12.9 (2.7 dropped; reachable via apt python2.7) Octave 5.1.0 -> 9.2.0 OpenJDK 13.0.1 -> 21.0.5 (LTS) Bash 5.0 -> 5.2.21 FPC 3.0.4 -> 3.2.2 GHC 8.8.1 -> 9.6.6 Mono 6.6.0.161 -> 6.8.0.105 (bookworm apt; upstream EOL) Node.js 12.14.0 -> 22.15.0 Erlang/OTP 22.2 -> 27.3 Elixir 1.9.4 -> 1.18.3 Rust 1.40.0 -> 1.87.0 Go 1.13.5 -> 1.24.3 (go.dev/dl) FreeBASIC 1.07.1 -> 1.10.1 OCaml 4.09.0 -> 5.2.0 PHP 7.4.1 -> 8.3.19 DMD 2.089.1 -> 2.109.1 Lua 5.3.5 -> 5.4.7 TypeScript 3.7.4 -> 5.4.5 (via Node 22) NASM 2.14.02 -> 2.16.03 GNU Prolog 1.4.5 -> 1.5.0 SBCL 2.0.0 -> 2.4.6 GnuCOBOL 2.2 -> 3.2 Swift 5.2.3 -> 5.10.1 (Ubuntu 22.04 tarball — ABI-compatible) Kotlin 1.3.70 -> 2.0.21 Clang 7 -> 14 (bookworm apt) R 4.0.0 -> 4.4.2 Scala 2.13.2 -> 3.4.2 Clojure 1.10.1 -> 1.11.4 (built with Maven 3.9.6 from archive.apache.org) .NET SDK 3.1.202 -> 8.0.404 (LTS) Groovy 3.0.3 -> 4.0.24 (archive.apache.org; dl.bintray.com sunset) Also update tests/<lang>/lang.properties so generate_json.py emits the new VERSIONS strings. Clang tests now reference clang-14 instead of clang-7; objective-c gcc include path bumped from gcc/8 to gcc/12 to match bookworm. Net effect on /languages: 46 entries -> 41 (collapsed 3x GCC + 2x Python multi-version pins into a single current version each). Legacy GCC and Python language IDs from db/languages/active.rb will be repointed to the new install paths in the talview/judge0 follow-up PR so historical submission FK rows remain valid. Refs SRE-2962, IR-2665.
…bump chore(SRE-3107): migrate to Debian Bookworm base and bump all 30 language versions
Replace the 2021-era judge0/isolate@ad39cc4 fork (cgroupv1-only) with upstream ioi/isolate v2.6, which is cgroupv2-only and required for running on standard AKS nodepools (Ubuntu 22.04 / cgroupv2). - Add libseccomp-dev (v2.4+ syscall filter), libsystemd-dev, asciidoc + docbook deps so the binary build doesn't need network DTDs. - Build isolate, isolate-cg-keeper, isolate-check-environment by hand (skip 'make install' to avoid pulling in the manpage targets). - Ship /usr/local/etc/isolate config with manual cg_root delegation (no systemd in container), uid/gid range, num_boxes, and syscall_flags=0 to disable the v2.4+ seccomp filter (Go's build cache trim relies on F_OFD_SETLK). - Bump LABEL version to 2.1.0. Verified locally on a cgroupv2 docker host: 8 languages run hello-world with judge0 wait=true (Python 3.12, Java 21, Go 1.24, C++ GCC 14, Rust 1.87, Ruby 3.3, Kotlin 2.0, Bash 5).
feat(SRE-3142): swap to upstream isolate v2.6 for cgroupv2 support
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two changes bundled in one PR (they ride together — bookworm base unblocks newer toolchains, isolate v2.6 unblocks cgroupv2 hosts):
judge0/buildpack-deps:buster-2019-12-28→buildpack-deps:bookworm. Debian Buster reached EOL on 2024-06-30 and thedeb.debian.org/debian busterrepos are gone, so the existing image can no longer be cleanly rebuilt without rewriting sources.list at every layer.isolateswapped fromjudge0/isolate@ad39cc4(cgroupv1-only fork) → upstreamioi/isolate v2.6(cgroupv2-only since v2.0). This lets Judge0 run on modern hosts where cgroupv1 is no longer mounted (AKS Ubuntu 22.04, RHEL 9, Fedora 39+, etc.).Compiler version refresh (latest stable as of 2026-05)
Every language in the matrix was bumped to its current upstream stable while keeping all language paths discoverable so the API surface (
db/languages/active.rbin the consumer image) can move one at a time. Highlights:Each
tests/<lang>/lang.propertiesis updated to match.isolate v2.6 specifics
/usr/local/etc/isolateships withcg_root = /sys/fs/cgroup/isolate,first_uid = 60000,first_gid = 60000,syscall_flags = 0, andnum_boxes = 2147483647. The widenum_boxesrange matches Judge0'sbox_id = submission.id % 2147483647derivation — v1's defaultnum_boxes = 1000would silently fail any submission whoseid > 1000with "Sandbox ID out of range".libseccomp-dev,libsystemd-dev,asciidoc,docbook-xml,docbook-xsl,xsltproc,pkg-config.isolatebinary installed at/usr/local/bin/isolate(mode 4755), plusisolate-cg-keeperandisolate-check-environment.Consumer-side changes required
The matching consumer-image PR (cgroupv2 entrypoint setup + isolate-v2-compatible flags + memory-metric fallback for kernel < 5.19) is opened against
judge0/judge0— see linked PR there. They can be reviewed independently but should be released together.Verification
buildpack-deps:bookwormon x86_64.tests/<lang>/lang.propertieshello-worlds run green inside the image (same harness as today).compiler.talview.com(Talview's Judge0 instance). 9-language smoke run after deploy: 9/9 Accepted, memory metric populated (max-rss fallback on kernel 5.15).Notes for maintainers
talview.azurecr.io/judge0-compilers:bookworm-20260528-2285831and overlay tags.