Repository navigation
docker: the base-image tag is not the toolchain pin - #49
Conversation
Railway build failed:
failed to solve: docker.io/library/rust:1.98.1-slim-bookworm: not found
Both Dockerfiles used one `ARG RUST_VERSION=1.98.1` as BOTH the toolchain
version and the base-image tag. Measured against the registry: that tag is a
404, while `rust:1.98-slim-bookworm` and `rust:1.98.0-slim-bookworm` are 200,
and `static.rust-lang.org/dist/channel-rust-1.98.1.toml` is 200. So 1.98.1 is
a real Rust release and the CHANNEL was always valid -- what does not exist is
a docker-library IMAGE for that patch. Conflating the two made a valid pin
depend on whether someone tagged an image for it.
The base now floats on the MINOR tag (`ARG RUST_IMAGE_TAG=1.98-slim-bookworm`),
which docker-library always publishes.
The exact toolchain comes from rust-toolchain.toml, which is now COPY'd into
the builder ahead of the sources with a `rustup show` to materialise it. That
closes a separate gap found while fixing this one: the pin file was NEVER
copied into either image, so a Railway build's toolchain was whatever the base
tag shipped and the pin had no effect there at all -- the exact cross-file
drift that file was added to end, still open on the one path nobody checked.
Copying it first also means a pin bump invalidates the toolchain layer and
nothing below it.
Consequence: bumping the toolchain is now a one-line edit in
rust-toolchain.toml. `RUST_IMAGE_TAG` moves only when the MINOR does, and
never to a patch-level tag -- that is the shape that broke.
Diagnostic note recorded in both files: BuildKit resolves every stage's base
in parallel, so the last `load metadata` line printed is often the healthy one
(`debian:bookworm-slim`, which resolves fine). Read `failed to solve:`.
NOT BUILT HERE -- no Docker daemon in this environment (client only). The
registry probes above are real; the image build is not. Railway is the gate.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011DN5odWu4eisdevH9bPWyz
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Essentials Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe Railway builders now use the available ChangesRust builder alignment
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: Poem
Comment |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_e3f3997e-e0dd-41dc-8bf3-04e81d2ff3c6) |
Fixes the Railway build:
What was wrong
Both Dockerfiles used a single
ARG RUST_VERSION=1.98.1as both the toolchain version and the base-image tag. Measured against the registry:rust:1.98.1-slim-bookwormrust:1.98.0-slim-bookwormrust:1.98-slim-bookwormdebian:bookworm-slimstatic.rust-lang.org/dist/channel-rust-1.98.1.tomlSo 1.98.1 is a real Rust release and the channel was always valid — what does not exist is a docker-library image for that patch. The official-images repo does not tag every point release. Conflating the two made a valid toolchain pin depend on whether someone happened to publish an image for it.
No fork of anything is required, and nothing is missing from Docker Hub that would need vendoring.
Diagnostic note (recorded in both files)
The failure reads confusingly. BuildKit resolves every stage's base in parallel, so the last line printed is often the healthy one:
debian:bookworm-slimresolves fine — it is a red herring. Read thefailed to solve:line, not the lastload metadataline.The fix
ARG RUST_IMAGE_TAG=1.98-slim-bookworm, which docker-library always publishes.rust-toolchain.toml, nowCOPY'd into the builder ahead of the sources with arustup showto materialise it.A second gap, found while fixing the first
rust-toolchain.tomlwas never copied into either image. A Railway build's toolchain was therefore whatever the base tag shipped, and the pin file had no effect on that path at all — the exact cross-file drift the file was added to end, still open on the one path nobody was checking. Its own header says it exists because the toolchain was previously carried "only as PROSE … the two Dockerfiles'ARG RUST_VERSION"; the Docker half of that was never actually closed.Copying it first also means a pin bump invalidates the toolchain layer and nothing below it.
Consequence: bumping the toolchain is now a one-line edit in
rust-toolchain.toml.RUST_IMAGE_TAGmoves only when the MINOR does, and never to a patch-level tag — that is the shape that broke.Cost, stated
The base tag resolves to 1.98.0 and rustup then installs 1.98.1 alongside it, so the builder stage carries two toolchains. The runtime stage is unchanged
debian:bookworm-slimwith only the stripped binary, so the shipped image is not affected.⚠ Not built here
No Docker daemon in this environment (client only), so the image was not built. What is measured is real: the registry probes above, and
rust-toolchain.tomlstill parsing to{channel: "1.98.1", components: ["rustfmt", "clippy"]}. Railway is the gate.Branch note
claude/rust-scratch-abi-soa-gsamge's previous PR (#18) merged on 2026-08-04; the branch held only already-merged history (0 ahead, 67 behind), so it was restarted frommainper the standing rule rather than stacking on merged commits.🤖 Generated with Claude Code
https://claude.ai/code/session_011DN5odWu4eisdevH9bPWyz
Generated by Claude Code
Summary by CodeRabbit
Bug Fixes
Documentation