update-alternatives silently replaces the python3-minimal-owned /usr/bin/python3 symlink; harmless in this image, a trap for derived images (CR-A16-106) #538

Wave 2 · theme D2-7: Next-release technology updates · highest severity Info · 2 finding(s) · effort small

Summary

A deployer extends the image with RUN apt-get install -y python3-apt (or another compiled python3-* package). The package's modules target 3.10, but /usr/bin/python3 is 3.11, so its tools fail with ImportError on the C extension.

Primary finding

CR-A16-106 — update-alternatives silently replaces the python3-minimal-owned /usr/bin/python3 symlink; harmless in this image, a trap for derived images

severity Info · reachability undocumented · intent intended-and-acceptable · confidence likely · single reviewer · not reproduced (code trace)

What happens. Dockerfile:39 runs update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1. /usr/bin/python3 is a plain symlink owned by python3-minimal and pulled in as a python3-pip dependency. dpkg's update-alternatives replaces an existing symlink, so python3 becomes 3.11 for every later consumer, including /usr/bin/pip3 and Debian's py3compile/py3clean maintainer helpers. Inside this image, nothing apt-managed breaks: the alternative is set after apt-get finished in the same RUN, so all postinst scripts ran under 3.10. No apt operation follows, and with --no-install-recommends the image installs no compiled python3-* package (such as python3-apt). Images built FROM forgelm that apt-get install python3-* packages with C extensions (cpython-310 .so only) would fail at import time under /usr/bin/python3, and dpkg will keep the alternative over python3-minimal's own link. This is offline reasoning about dpkg behaviour, not reproduced. Rated info.

Where.

• Dockerfile:33-39

Evidence.

• Dockerfile:33-39. No later apt-get call in Dockerfile:40-113.

Recommended fix. Use a venv on PATH (see the pip finding) instead of repointing the system python3.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

TECH-T13-007 — Python, platform, CI, container and GPU prices: Ubuntu 22.04 apt python3.11 (+ python3-pip, update-alternatives) in the Docker image (outdated)

severity Next release

Item. Ubuntu 22.04 apt python3.11 (+ python3-pip, update-alternatives) in the Docker image · verdict: outdated · urgency: Next release

State in ForgeLM. Dockerfile:33-39 apt-installs python3.11, python3.11-venv, python3-pip on Ubuntu 22.04 and repoints /usr/bin/python3 to 3.11 with update-alternatives; packages go into the system interpreter (no venv).

State of the ecosystem on 2026-10-01. jammy-updates python3.11 is 3.11.0rc1-122.04.1 in universe (Launchpad, published 2026-08-26; packages.ubuntu.com). Its changelog shows the only change since the 2022 backport of CPython 3.11.0 release candidate 1 is one SRU fixing an ssl.SSLSocket.session memory leak (dated 2026-06-29), so none of the upstream 3.11.x bugfix/security releases are included. jammy python3-pip is 22.0.2. Canonical: 22.04 LTS standard security maintenance to May 2027 (ESM to May 2032); 24.04 to May 2029 with python3 3.12.3 in main; 26.04 LTS released April 2026. torch cp311 manylinux_2_28 wheels are compatible with jammy's glibc 2.35, and pip's Requires-Python check uses the release tuple, so installation should succeed (not executed: no Docker).

Impact. Dockerfile:33-39: the container's interpreter is a pre-release CPython build in a component without standard Canonical security coverage, with a 2022 pip; update-alternatives also repoints system python3 used by apt tooling.

Recommendation. Move to ubuntu24.04 with python3.12 from main inside a venv (PEP 668 blocks system pip there), or install a current CPython explicitly (uv / python-build-standalone). Drop the update-alternatives override and upgrade pip inside the venv.

Sources.

• Launchpad published sources: python3.11 (jammy-updates 3.11.0rc1-122.04.1, universe) (2026-08-26 (published))
• Ubuntu jammy-updates python3.11 package page (2026-10-01)
• Ubuntu changelog python3.11 3.11.0rc1-122.04.1 (only post-2022 change: SSL memory-leak SRU, 2026-06-29) (2026-06-29)
• Ubuntu jammy python3-pip (22.0.2) (2026-10-01)
• Ubuntu noble python3 (3.12.3, main) (2026-10-01)
• Ubuntu release cycle (22.04 standard support May 2027; 24.04 May 2029; 26.04 released Apr 2026) (2026-10-01)

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}