Context
Supabase moved the PostgreSQL 17 line to an Alpine userland at roughly 17.6.1.084. #58 added support for those bases and publishes them as opt-in tags (:17-alpine, :17-alpine-<ver>, :17.6.1.151). The shared :17 alias deliberately still points at the Ubuntu build on base 17.6.1.071.
That Ubuntu base is frozen — Supabase will not ship another PG17 Ubuntu image, so it never receives another userland patch and its CVE surface only grows. Leaving :17 there indefinitely is not viable, but flipping it is a breaking change for everyone who pinned :17.
Prerequisite before flipping
The Alpine image is verified to build and load the extension (CI smoke test on amd64 since #58; manual arm64 run against the real 17.6.1.151 base). It has not been run inside a full self-hosted Supabase stack, where auth / storage / realtime / supavisor connect to the db container and may assume Ubuntu tooling. That validation should land before :17 moves.
Proposed sequence
Release N — this issue
- Publish
:17-ubuntu and :17-ubuntu-<version> from the existing Ubuntu PG17 row, in addition to the current :17 / :17-<version> aliases, so existing pins keep working while a stable landing spot exists.
- Document the tag in
docs/postgresql/quickstarts/supabase-self-hosted.md and docker/README.md, and add it to the release-notes body in .github/workflows/main.yml.
- Announce in the release notes that
:17 will move to Alpine in a future release.
Release N+1 — the flip
- Point
:17 / :17-<version> at the Alpine row.
- Keep
:17-alpine working as an alias, and :17-ubuntu for anyone who has not migrated.
Later
- Retire
:17-ubuntu once staying on the frozen base is untenable.
Implementation note
The tag_suffix mechanism added in #58 will not do this on its own. Tags are built as ${IMAGE}:${pg_major}${SUFFIX} — setting tag_suffix: '-ubuntu' on the Ubuntu PG17 row would publish :17-ubuntu instead of :17, not alongside it. Step N needs the Ubuntu row to emit both, so the tag-list construction in the set docker tags and build args (supabase) step needs a small extension (e.g. an optional extra_tags matrix key) rather than just a suffix.
Naming rule to settle first
PG15 stays on Ubuntu — Supabase kept that line there — so there is no :15-alpine / :15-ubuntu split and there should not be one. Introducing -ubuntu / -alpine for 17 only makes the scheme non-uniform across majors.
Suggested durable rule: :<major> follows whatever base Supabase ships for that major, with -ubuntu / -alpine treated as transitional migration tags that get retired. Deciding this up front means :17-ubuntu ships with an exit plan instead of becoming permanent by default.
Acceptance criteria
Follow-up to #58 (open point 1).
Context
Supabase moved the PostgreSQL 17 line to an Alpine userland at roughly
17.6.1.084. #58 added support for those bases and publishes them as opt-in tags (:17-alpine,:17-alpine-<ver>,:17.6.1.151). The shared:17alias deliberately still points at the Ubuntu build on base17.6.1.071.That Ubuntu base is frozen — Supabase will not ship another PG17 Ubuntu image, so it never receives another userland patch and its CVE surface only grows. Leaving
:17there indefinitely is not viable, but flipping it is a breaking change for everyone who pinned:17.Prerequisite before flipping
The Alpine image is verified to build and load the extension (CI smoke test on amd64 since #58; manual arm64 run against the real
17.6.1.151base). It has not been run inside a full self-hosted Supabase stack, where auth / storage / realtime / supavisor connect to the db container and may assume Ubuntu tooling. That validation should land before:17moves.Proposed sequence
Release N — this issue
:17-ubuntuand:17-ubuntu-<version>from the existing Ubuntu PG17 row, in addition to the current:17/:17-<version>aliases, so existing pins keep working while a stable landing spot exists.docs/postgresql/quickstarts/supabase-self-hosted.mdanddocker/README.md, and add it to the release-notes body in.github/workflows/main.yml.:17will move to Alpine in a future release.Release N+1 — the flip
:17/:17-<version>at the Alpine row.:17-alpineworking as an alias, and:17-ubuntufor anyone who has not migrated.Later
:17-ubuntuonce staying on the frozen base is untenable.Implementation note
The
tag_suffixmechanism added in #58 will not do this on its own. Tags are built as${IMAGE}:${pg_major}${SUFFIX}— settingtag_suffix: '-ubuntu'on the Ubuntu PG17 row would publish:17-ubuntuinstead of:17, not alongside it. Step N needs the Ubuntu row to emit both, so the tag-list construction in theset docker tags and build args (supabase)step needs a small extension (e.g. an optionalextra_tagsmatrix key) rather than just a suffix.Naming rule to settle first
PG15 stays on Ubuntu — Supabase kept that line there — so there is no
:15-alpine/:15-ubuntusplit and there should not be one. Introducing-ubuntu/-alpinefor 17 only makes the scheme non-uniform across majors.Suggested durable rule:
:<major>follows whatever base Supabase ships for that major, with-ubuntu/-alpinetreated as transitional migration tags that get retired. Deciding this up front means:17-ubuntuships with an exit plan instead of becoming permanent by default.Acceptance criteria
CREATE EXTENSION):17-ubuntu+:17-ubuntu-<version>published alongside:17:17-on-Ubuntu announced in a releaseFollow-up to #58 (open point 1).