[Vishalan]

Problem

The image is built FROM python:3.11-slim-bullseye. Debian 11 is end-of-life: its apt mirrors (deb.debian.org/debian, debian-security) return 404, so any build without cached layers fails at apt-get update. It also means the production (web) image runs on an OS that no longer gets security fixes.

Change (2 lines, Dockerfile only)

• FROM python:3.11-slim-bullseye -> FROM python:3.11-slim-bookworm. Same Python minor version; no Python or dependency changes.
• apt install netcat -> netcat-traditional. On bookworm netcat is a virtual package (no install candidate). netcat-traditional is what the netcat alias resolved to on bullseye, so nc -z redis 6379 in docker-compose.yml behaves the same.

Deliberately not changed: Python version, nginx:1.23.3 stage, pip/requirements, other apt packages (libmariadb-dev, dnsutils and the rest install unchanged on bookworm).

Testing (Docker, Colima)

• Built the web, static_resource_builder and nginx targets: all succeed, no apt errors.
• In the image: Debian 12, Python 3.11.18, nc is netcat-traditional v1.10-47 and nc -z works, dig present, mysqlclient imports, container runs as non-root app (uid 1001) with /ebs/logs and /srv/code/dev ownership unchanged.
• make test: 140 passed, 8 skipped. make lint: passed.
• Note: on a cold container the first make test can start pytest before the access modules finish cloning and report collection errors (62 passed); re-running gives the full 140. This is a pre-existing startup race, not related to this change.
• make test on a fresh checkout also needs the bootstrap_secrets.sh fix in fix(scripts): tolerate SIGPIPE in bootstrap_secrets randstr #356 (I passed MYSQL_ROOT_PASSWORD / APP_TOKEN as env vars to work around it).

Please check before merging

• Deploy/publish: docker-push.yml publishes browserstack/enigma (web target, amd64 + arm64) on v* tags. I tested amd64/arm64 natively on the build host only; whoever owns deploys should confirm a bookworm-based image is acceptable. The multi-arch publish build runs only on a tag, so it is untested here.
• Anything inside the image relying on bullseye-specific package versions (glibc 2.31 -> 2.36, OpenSSL 1.1.1 -> 3.0 from the OS) is not covered by the test suite.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: cd6c4bc0-972f-4f36-8075-08f7e0b1547a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts