Upgrade ABC container images from Ubuntu 24.04 to 26.04 LTS #40

New Issue

2026-10-09T04:56:18-07:00

westfarn commented

2026-10-09 04:56:18 -07:00

Summary

App hosts already run Ubuntu 26.04 LTS. The only deployed containers that are Ubuntu are still 24.04:

Container	Image source	Running OS (adama)
`abc_be` beta	GIS/abc_be `Dockerfile` `FROM ubuntu:24.04`	Ubuntu 24.04.5 LTS
`abc_worker` beta	GIS/abc_worker `Dockerfile` `FROM ubuntu:24.04`	Ubuntu 24.04.5 LTS
`abc_voice` beta	same `abc_worker` image (`docker-compose.voice.yml`)	Ubuntu 24.04.5 LTS

This is not a one-line base-image bump. Ubuntu 26.04 (Resolute) ships Python 3.14 and does not publish python3.12 in the archive. Both Dockerfiles apt-get install python3.12. abc_be also hardcodes /opt/venv/lib/python3.12/site-packages/ in the django-cryptography patch.

requires-python is >=3.12 in both projects, so 3.14 is allowed. abc_worker's uv.lock already has a python_full_version >= '3.14' resolution marker.

Work

1. GIS/abc_be

FROM ubuntu:26.04
Install python3.14, python3.14-venv, python3.14-dev (plus the existing curl, build-essential, libpq-dev)
Point the django-cryptography sed at the 3.14 site-packages path
Confirm uv sync --frozen still resolves on 3.14 (relock if the lock has no 3.14 marker)

2. GIS/abc_worker (covers abc_voice)

Same base and Python package change
Keep tesseract-ocr and uv sync --frozen --no-dev --extra av
abc_voice has no separate Dockerfile

3. Verify

Rebuild beta on one host (./scripts/deploy.sh adama --app abc_be --env beta, then abc_worker and abc_voice). Inside the container, /etc/os-release should be Ubuntu 26.04 and python should be 3.14. Smoke the three beta URLs before rolling the other app hosts.

Out of scope

Django apps (company_site, dta_service, scha, chat_backend, monica_site, url_shortening_service, college_craft) use python:3.12-slim and run Debian 13, not Ubuntu
WordPress (wordpress:6-apache) is Debian 13
web-static nginx and LiveKit are Alpine
Alloy (grafana/alloy:v1.7.1) reports Ubuntu 24.04.1 inside the upstream image. Base OS is not ours to change

Acceptance criteria

abc_be and abc_worker Dockerfiles use ubuntu:26.04 and install Python 3.14 from the Ubuntu archive
abc_be django-cryptography patch targets the 3.14 site-packages path
Beta abc_be, abc_worker, and abc_voice containers on one host report Ubuntu 26.04 and start cleanly
No deploy change required in this repo beyond rebuilding from the updated app repos

## Summary App hosts already run Ubuntu 26.04 LTS. The only deployed containers that are Ubuntu are still **24.04**: | Container | Image source | Running OS (adama) | |-----------|--------------|--------------------| | `abc_be` beta | [GIS/abc_be](https://git.aimloperations.com/GIS/abc_be) `Dockerfile` `FROM ubuntu:24.04` | Ubuntu 24.04.5 LTS | | `abc_worker` beta | [GIS/abc_worker](https://git.aimloperations.com/GIS/abc_worker) `Dockerfile` `FROM ubuntu:24.04` | Ubuntu 24.04.5 LTS | | `abc_voice` beta | same `abc_worker` image (`docker-compose.voice.yml`) | Ubuntu 24.04.5 LTS | This is not a one-line base-image bump. Ubuntu 26.04 (Resolute) ships **Python 3.14** and does not publish `python3.12` in the archive. Both Dockerfiles `apt-get install python3.12`. `abc_be` also hardcodes `/opt/venv/lib/python3.12/site-packages/` in the django-cryptography patch. `requires-python` is `>=3.12` in both projects, so 3.14 is allowed. `abc_worker`'s `uv.lock` already has a `python_full_version >= '3.14'` resolution marker. --- ## Work ### 1. GIS/abc_be - `FROM ubuntu:26.04` - Install `python3.14`, `python3.14-venv`, `python3.14-dev` (plus the existing `curl`, `build-essential`, `libpq-dev`) - Point the django-cryptography `sed` at the 3.14 site-packages path - Confirm `uv sync --frozen` still resolves on 3.14 (relock if the lock has no 3.14 marker) ### 2. GIS/abc_worker (covers abc_voice) - Same base and Python package change - Keep `tesseract-ocr` and `uv sync --frozen --no-dev --extra av` - `abc_voice` has no separate Dockerfile ### 3. Verify Rebuild beta on one host (`./scripts/deploy.sh adama --app abc_be --env beta`, then `abc_worker` and `abc_voice`). Inside the container, `/etc/os-release` should be Ubuntu 26.04 and `python` should be 3.14. Smoke the three beta URLs before rolling the other app hosts. --- ## Out of scope - Django apps (`company_site`, `dta_service`, `scha`, `chat_backend`, `monica_site`, `url_shortening_service`, `college_craft`) use `python:3.12-slim` and run **Debian 13**, not Ubuntu - WordPress (`wordpress:6-apache`) is Debian 13 - `web-static` nginx and LiveKit are Alpine - Alloy (`grafana/alloy:v1.7.1`) reports Ubuntu 24.04.1 inside the upstream image. Base OS is not ours to change --- ## Acceptance criteria - [ ] `abc_be` and `abc_worker` Dockerfiles use `ubuntu:26.04` and install Python 3.14 from the Ubuntu archive - [ ] `abc_be` django-cryptography patch targets the 3.14 site-packages path - [ ] Beta `abc_be`, `abc_worker`, and `abc_voice` containers on one host report Ubuntu 26.04 and start cleanly - [ ] No deploy change required in this repo beyond rebuilding from the updated app repos

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ai_ml_operations/server-infra#40