Change sources of our docker images

[potiuk]

Body

The "official" Python images are far less official than we thought. They are built by the community and while they are somewhat supervised by the "official Docker image program" there is really little control over the build and release process.

We should change the way we build our images to install Python on base debian image from "official" releases rather than use "python" base images for it.

That has also some benefits - for example setuptools are quite old in those images and they tend to have security issues - if we decide when we rebuild the base images we can have better control over what is in the images.

We might also finally plug it in with automated snyk scanning and break releases if snyk does not pass.

Committer

• I acknowledge that I am a maintainer/committer of the Apache Airflow project.

[potiuk]

Also we should add optional golang installation when we build the image.

[potiuk]

Currently we are building our images by passing it image it should be build from

The command is similar to:

docker buildx build --load --builder default --progress=auto --cache-from=ghcr.io/apache/airflow/v2-11-test/ci/python3.9:cache-linux-amd64 --pull --build-arg AIRFLOW_BRANCH=v2-11-test --build-arg AIRFLOW_CONSTRAINTS_MODE=constraints-source-providers --build-arg AIRFLOW_CONSTRAINTS_REFERENCE=constraints-2-11 --build-arg AIRFLOW_EXTRAS=devel-ci --build-arg AIRFLOW_IMAGE_DATE_CREATED=2025-06-23T18:48:03Z --build-arg AIRFLOW_IMAGE_REPOSITORY=https://github.com/apache/airflow --build-arg AIRFLOW_USE_UV=true --build-arg UV_HTTP_TIMEOUT=300 --build-arg AIRFLOW_VERSION=2.11.0.dev0 --build-arg BUILD_ID=0 --build-arg CONSTRAINTS_GITHUB_REPOSITORY=apache/airflow --build-arg PYTHON_BASE_IMAGE=python:3.9-slim-bookworm --build-arg BUILD_PROGRESS=auto --build-arg INSTALL_MYSQL_CLIENT_TYPE=mariadb --build-arg VERSION_SUFFIX_FOR_PYPI=dev0 -t ghcr.io/apache/airflow/v2-11-test/ci/python3.9 --target main . -f Dockerfile.ci --platform linux/amd64

The importan thing is this arg:

• PYTHON_BASE_IMAGE=python:3.9-slim-bookworm

Rather than that, we should have BASE_IMAGE (debian:slim-bookworm) and pass PYTHON_MAJOR_MINOR_VERSION simplyh (this is the name we use internally and we automaticallly extract it in the images from installed python version.

Then - one of the first step in our build should be to install python - ideally from official sources - but maybe we find other, faster way (building python is SLOW and requires build tools.

We should first start with CI images and apply the changes toi PROD after we test it for a while on CI.

[potiuk]

This one still needs PROD image update - reopening.