build: pin pg_repack builder base

[MicBun]

resolves: https://github.com/truflation/website/issues/4070

What

Pin the pg_repack_builder stage in deployments/Dockerfile to postgres:16-alpine3.21 instead of the floating postgres:16-alpine tag.

Why

The floating postgres:16-alpine tag has moved to Alpine 3.24, which dropped the clang19 and llvm19 packages this stage installs. apk add … clang19 … llvm19 no longer resolves, so the build fails before producing the node image:

#15 [pg_repack_builder 2/2] RUN apk add --no-cache build-base clang19 gawk llvm19 ...
ERROR: unable to select packages:
  clang19 (no such package): required by: world[clang19]
  llvm19 (no such package): required by: world[llvm19]

The clang19/llvm19 line landed when postgres:16-alpine was Alpine 3.21; the tag has since drifted. The build and runtime stages are already pinned (golang:1.25.3-alpine3.21, alpine:3.21) — only the pg_repack builder floated, which also meant pg_repack was compiled against a newer libc than the alpine:3.21 runtime it is copied into.

Pinning to postgres:16-alpine3.21 restores clang19/llvm19 and aligns the builder's Alpine (3.21.x) with the runtime stage so the copied pg_repack binary is ABI-consistent.

Impact

Anything that builds deployments/Dockerfile is currently affected:

• node CI acceptance-test (auto-builds the tn-db service from this Dockerfile)
• the Publish Node Image workflow — so ghcr.io/trufnetwork/node:latest can be refreshed past v2.5.2
• downstream repos that build node main in CI

Verification

Built the pg_repack_builder target against the pinned base: clang19/llvm19 resolve and pg_repack 1.5.3 compiles and installs (docker build --target pg_repack_builder → exit 0).

Optional follow-up

Consider digest-pinning the runtime alpine:3.21 base and/or adding a Dependabot/Renovate rule for the base images, so a future Alpine 3.21 EOL surfaces as a PR rather than a silent CI break.

Summary by CodeRabbit

• Chores
  • Updated Docker base image version for build stage to ensure compatibility and consistency with runtime dependencies.

[holdex]

Time Submission Status

Member	#	Time	Running Total	Status	Last Update
MicBun			4h	✅ Submitted	Jun 18, 2026, 1:22 PM

---

Submit or update total time with:

@holdex pr submit-time 2h

Add time on top of previous submission with:

@holdex pr add-time 1h30m

See available commands to help comply with our Guidelines.

[MicBun]

@holdex pr submit-time 4h

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 55673b88-2fc9-470d-bc78-e75a833e94ad

📥 Commits

Reviewing files that changed from the base of the PR and between 290eb7c and 0392e9f.

📒 Files selected for processing (1)

• deployments/Dockerfile

---

📝 Walkthrough

Walkthrough

The pg_repack_builder stage in deployments/Dockerfile has its base image changed from the floating postgres:16-alpine tag to the pinned postgres:16-alpine3.21. Inline comments are added explaining that the Alpine version pin is required to maintain libc/ABI compatibility with the runtime stage (alpine:3.21).

Changes

Alpine Version Pin in Dockerfile

Layer / File(s)	Summary
Pin pg_repack_builder base image to alpine3.21 deployments/Dockerfile	pg_repack_builder stage base image changed from postgres:16-alpine to postgres:16-alpine3.21; comments added explaining the Alpine version pin is required for libc/ABI consistency with the runtime stage.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐇 A floating tag, oh what a fright,
The libc versions weren't quite right.
So bunny pinned to alpine3.21,
Now build and runtime live as one!
ABI matched — a hoppy delight. 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'build: pin pg_repack builder base' accurately and concisely describes the main change: pinning the pg_repack_builder base image to a specific Alpine version.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/pin-pg-repack-builder-base

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}