#28 - Use the France Ubuntu mirror via a UBUNTU_MIRROR build argument #29

Merged

GuillaumeHemmen merged 1 commit from 28-use-fr-ubuntu-mirror into master

2026-09-11 08:49:44 +00:00

claude-bot commented

2026-09-11 08:07:16 +00:00

Member

What

Every variant now installs packages from the France Ubuntu mirror (http://fr.archive.ubuntu.com/ubuntu) instead of archive.ubuntu.com / security.ubuntu.com. The mirror comes from a new UBUNTU_MIRROR build argument, and the README explains the change to image users: what changed, what it means for them, and how to switch mirrors or restore Ubuntu's defaults.

Why

See #28. Canonical's main archive is down, so every apt-get stalls on retries: #22's coder-xfce-vnc build took 48 minutes, and the first desktop attempts were cancelled after about 38. The default mirrors are usually fine, but a release can't wait for Canonical to recover, and country mirrors run on separate hosts. From the build cluster, fr.archive.ubuntu.com answers in 55–73 ms, while every archive.ubuntu.com address times out.

Changes

Dockerfile, base stage:
- ARG UBUNTU_MIRROR=http://fr.archive.ubuntu.com/ubuntu, with a comment explaining why, the security-update trade-off, and how to override it. Also listed in the header's build-argument list.
- LABEL com.van-hemmen.sindri.ubuntu-mirror="${UBUNTU_MIRROR}", so the mirror shows up in docker inspect.
- At the start of the first RUN, when UBUNTU_MIRROR is set:
  - it fails with a hint if /etc/apt/sources.list.d/ubuntu.sources doesn't exist (Ubuntu before 24.04);
  - it copies the original file to /usr/share/sindri/ubuntu.sources.orig;
  - it rewrites both source blocks, the main archive and noble-security, to the mirror;
  - it checks that every URIs: line now points at the mirror.
  An empty value skips all of this, and the build keeps Ubuntu's sources exactly as shipped. Later stages inherit the rewritten file, so there's nothing to change per variant.
README.md:
- Notice under the intro: tells readers the published images use the France mirror, and links to the details.
- New "Ubuntu Package Mirror" section:
  - why the mirror is used, plus what it means: packages are still signature-checked, security updates can arrive a few hours late, and speed depends on location;
  - how to check which mirror an image uses (docker inspect label or grep '^URIs:');
  - how to build with another mirror or with Ubuntu's sources (--build-arg UBUNTU_MIRROR=), and what happens on bases older than 24.04;
  - how to restore Ubuntu's sources in a derived image or a running workspace, noting that /etc isn't on the PVC, so a workspace needs the cp in its startup_script.
- "Available arguments", "Extending the Image" (including the USER root step for coder variants) and "Version Information" updated to match.

Verification

In pods on talos-ovh-worker-two, using the step pulled from the Dockerfile by script:

Check	Result
Full base `RUN` step on `ubuntu:24.04` with the default mirror	pass in 46 s (apt installs + Azul JDK), while the stock mirrors time out
Rewritten `ubuntu.sources`	both blocks `URIs: http://fr.archive.ubuntu.com/ubuntu/`; suites and keyring unchanged
`/usr/share/sindri/ubuntu.sources.orig`	stock `archive.ubuntu.com` + `security.ubuntu.com` sources
`apt-get update` afterwards	exit 0, no `W:`/`E:` lines; `apt-cache policy` shows `fr.archive.ubuntu.com`, `noble-security` included
Documented restore (`cp …orig …`)	sources back to stock
`UBUNTU_MIRROR=` (empty)	sources byte-identical to stock, no backup directory
`UBUNTU_MIRROR=http://de.archive.ubuntu.com/ubuntu/` (trailing slash)	normalised to `URIs: http://de.archive.ubuntu.com/ubuntu/`
`ubuntu:22.04` with the default mirror	`UBUNTU_MIRROR needs /etc/apt/sources.list.d/ubuntu.sources (Ubuntu 24.04+); pass --build-arg UBUNTU_MIRROR= to keep the stock sources.`, exit 1

Wording-only comment edits were made after the test; the extracted RUN step is byte-identical to the tested one. The branch push also starts the full docker-dev build.

Not verified: the docker inspect label output, since there's no local Docker.

Note for #22 / #23

Once this is merged, rebasing them onto master should bring their build times back to normal while Canonical is down.

Closes #28

🤖 Generated with Claude Code

https://claude.ai/code/session_01XPajGyTH2js52mY5WSJoNA

## What Every variant now installs packages from the **France Ubuntu mirror** (`http://fr.archive.ubuntu.com/ubuntu`) instead of `archive.ubuntu.com` / `security.ubuntu.com`. The mirror comes from a new `UBUNTU_MIRROR` build argument, and the README explains the change to image users: what changed, what it means for them, and how to switch mirrors or restore Ubuntu's defaults. ## Why See #28. Canonical's main archive is down, so every `apt-get` stalls on retries: #22's `coder-xfce-vnc` build took 48 minutes, and the first desktop attempts were cancelled after about 38. The default mirrors are usually fine, but a release can't wait for Canonical to recover, and country mirrors run on separate hosts. From the build cluster, `fr.archive.ubuntu.com` answers in 55–73 ms, while every `archive.ubuntu.com` address times out. ## Changes - **`Dockerfile`, base stage:** - `ARG UBUNTU_MIRROR=http://fr.archive.ubuntu.com/ubuntu`, with a comment explaining why, the security-update trade-off, and how to override it. Also listed in the header's build-argument list. - `LABEL com.van-hemmen.sindri.ubuntu-mirror="${UBUNTU_MIRROR}"`, so the mirror shows up in `docker inspect`. - At the start of the first `RUN`, when `UBUNTU_MIRROR` is set: - it fails with a hint if `/etc/apt/sources.list.d/ubuntu.sources` doesn't exist (Ubuntu before 24.04); - it copies the original file to `/usr/share/sindri/ubuntu.sources.orig`; - it rewrites both source blocks, the main archive and `noble-security`, to the mirror; - it checks that every `URIs:` line now points at the mirror. An **empty value skips all of this**, and the build keeps Ubuntu's sources exactly as shipped. Later stages inherit the rewritten file, so there's nothing to change per variant. - **`README.md`:** - **Notice under the intro:** tells readers the published images use the France mirror, and links to the details. - **New "Ubuntu Package Mirror" section:** - why the mirror is used, plus what it means: packages are still signature-checked, security updates can arrive a few hours late, and speed depends on location; - how to check which mirror an image uses (`docker inspect` label or `grep '^URIs:'`); - how to build with another mirror or with Ubuntu's sources (`--build-arg UBUNTU_MIRROR=`), and what happens on bases older than 24.04; - how to restore Ubuntu's sources in a derived image or a running workspace, noting that `/etc` isn't on the PVC, so a workspace needs the `cp` in its `startup_script`. - "Available arguments", "Extending the Image" (including the `USER root` step for `coder` variants) and "Version Information" updated to match. ## Verification In pods on `talos-ovh-worker-two`, using the step pulled from the Dockerfile by script: | Check | Result | |---|---| | Full base `RUN` step on `ubuntu:24.04` with the default mirror | **pass in 46 s** (apt installs + Azul JDK), while the stock mirrors time out | | Rewritten `ubuntu.sources` | both blocks `URIs: http://fr.archive.ubuntu.com/ubuntu/`; suites and keyring unchanged | | `/usr/share/sindri/ubuntu.sources.orig` | stock `archive.ubuntu.com` + `security.ubuntu.com` sources | | `apt-get update` afterwards | exit 0, no `W:`/`E:` lines; `apt-cache policy` shows `fr.archive.ubuntu.com`, `noble-security` included | | Documented restore (`cp …orig …`) | sources back to stock | | `UBUNTU_MIRROR=` (empty) | sources byte-identical to stock, no backup directory | | `UBUNTU_MIRROR=http://de.archive.ubuntu.com/ubuntu/` (trailing slash) | normalised to `URIs: http://de.archive.ubuntu.com/ubuntu/` | | `ubuntu:22.04` with the default mirror | `UBUNTU_MIRROR needs /etc/apt/sources.list.d/ubuntu.sources (Ubuntu 24.04+); pass --build-arg UBUNTU_MIRROR= to keep the stock sources.`, exit 1 | Wording-only comment edits were made after the test; the extracted `RUN` step is byte-identical to the tested one. The branch push also starts the full `docker-dev` build. **Not verified:** the `docker inspect` label output, since there's no local Docker. ## Note for #22 / #23 Once this is merged, rebasing them onto `master` should bring their build times back to normal while Canonical is down. Closes #28 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01XPajGyTH2js52mY5WSJoNA

claude-bot added 1 commit

2026-09-11 08:07:16 +00:00

#28 - Use the France Ubuntu mirror via a UBUNTU_MIRROR build argument

/ docker-dev-ci (push) Successful in 3m46s

Details

/ docker-dev-coder (push) Successful in 4m2s

Details

/ docker-dev-coder-xfce-vnc (push) Successful in 9m2s

Details

bf7364c48a

Canonical's main archive (archive.ubuntu.com, security.ubuntu.com) went down
on 2026-09-11, stretching apt steps until the coder-xfce-vnc build took 48
minutes, too long to wait out before a release. Country mirrors keep
working through such outages. Add UBUNTU_MIRROR (default
http://fr.archive.ubuntu.com/ubuntu) to the base stage and rewrite the
deb822 ubuntu.sources to it, so every variant and every later apt-get
uses the mirror.

An empty value keeps the stock sources. The stock file is kept at
/usr/share/sindri/ubuntu.sources.orig for a one-line restore, the mirror
is recorded in the com.van-hemmen.sindri.ubuntu-mirror label, pre-24.04
bases fail with a hint, and the step asserts every source was rewritten.
README documents the mirror, its security-update trade-off, and how to
check, change, or restore it at build time and in existing images.

Closes #28

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XPajGyTH2js52mY5WSJoNA