From f87238b6c096ddc1bd4b4eadffd3e7031914def9 Mon Sep 17 00:00:00 2001 From: yml Date: Tue, 19 May 2026 22:39:53 +0800 Subject: [PATCH] fix: use Debian official HTTP mirrors in runtime stage (Tencent mirrors redirect to HTTPS which fails without ca-certificates on slim) --- deploy/docker/backend.Dockerfile | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/deploy/docker/backend.Dockerfile b/deploy/docker/backend.Dockerfile index 8a7d6210..fad273c1 100644 --- a/deploy/docker/backend.Dockerfile +++ b/deploy/docker/backend.Dockerfile @@ -76,11 +76,15 @@ WORKDIR /app # - python3: needed by venv (links to system libpython) # - tzdata: timezone data for TZ=Asia/Shanghai # - Chromium runtime libs: minimal set for headless Chromium on slim +# +# NOTE: We do NOT switch to Tencent mirrors here because: +# 1. slim image has no ca-certificates pre-installed +# 2. Tencent mirrors redirect HTTP → HTTPS, which fails without ca-certificates (chicken-and-egg) +# 3. Debian official HTTP mirrors (deb.debian.org) work without TLS verification +# 4. Apt packages are GPG-signed, so HTTP is safe RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \ --mount=type=cache,target=/var/lib/apt,sharing=locked \ - sed -i "s|http://deb.debian.org/debian|http://${DEBIAN_MIRROR}/debian|g" /etc/apt/sources.list.d/debian.sources \ - && sed -i "s|http://security.debian.org/debian-security|http://${DEBIAN_MIRROR}/debian-security|g" /etc/apt/sources.list.d/debian.sources \ - && apt-get update \ + apt-get update \ && apt-get install -y --no-install-recommends \ curl ca-certificates python3 tzdata \ libnss3 libnspr4 libdbus-1-3 libatk1.0-0 libatk-bridge2.0-0 \