build: pin the frontend builder image to the last QEMU-safe digest

Docker Hub rebuilt node:22-alpine on 2026-09-17 with the same Node
(22.23.2) but refreshed Alpine layers. That rebuild dies under QEMU while
cross-building the arm64 leg: `qemu: uncaught target signal 4 (Illegal
instruction)`, exit 132, during `pnpm install`.

Three consecutive release builds failed identically on it. Every other
input was unchanged and verified by digest — runner image 20260907.300.1,
tonistiigi/binfmt sha256:400a4873, pnpm pinned at 11.5.2, lockfile
untouched — and quality-checks, which runs natively, passed every time.
The tag was the only floating input:

  last green build 09-15  node:22-alpine@sha256:c610fcdf  built 2026-07-29
  failing         09-20   node:22-alpine@sha256:b6f26b36  built 2026-09-17

Pinned to the older of the two. It ships nothing: the builder stage is
discarded and only ui/dist is copied out, so no Alpine bytes reach the
runtime image and holding an older base costs no exposure.

This is a stopgap for the emulated build, not a fix for it. The durable
answer is building the arm64 leg on a native runner, which removes the
whole failure class.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Alex Shnitman
2026-09-20 10:28:10 +03:00
parent ec01524527
commit 300bf79b52
+13 -1
View File
@@ -2,7 +2,19 @@
# has lagged behind and resolved to a Node patch older than the Angular CLI's
# minimum supported version, breaking the build. node:22-alpine currently
# satisfies @angular/cli's >=22.22.3 requirement.
FROM node:22-alpine AS builder
#
# Pinned further, to a digest: Docker Hub rebuilt node:22-alpine on 2026-09-17
# with the same Node (22.23.2) but refreshed Alpine layers, and that rebuild
# dies under QEMU while cross-building the arm64 leg — `qemu: uncaught target
# signal 4 (Illegal instruction)`, exit 132, during `pnpm install`. Three
# consecutive release builds failed identically on it while every other input
# (runner image, binfmt digest, pnpm version, lockfile) was unchanged.
#
# This digest is the last image known to cross-build cleanly (built 2026-07-29).
# It ships nothing: this stage is thrown away and only ui/dist is copied out.
# Unpin once the arm64 leg builds natively instead of under emulation, or once
# a later node:22-alpine is confirmed to survive QEMU.
FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS builder
WORKDIR /metube
COPY ui ./