docs: document Ubuntu 26.04 Rust Coreutils and sudo-rs, add INSTALL_GNU_COREUTILS build flag

Agent-Logs-Url: https://github.com/phusion/baseimage-docker/sessions/065ff4d3-d584-4cb8-8265-5d1f0f7dc3b1

Co-authored-by: Theaxiom <57013+Theaxiom@users.noreply.github.com>

README.md

@@ -72,6 +72,7 @@ You can configure the stock `ubuntu` image yourself from your Dockerfile, so why
      * [The `docker-ssh` tool](#docker_ssh)
  * [Building the image yourself](#building)
    * [Removing optional services](#removing_optional_services)
+   * [Ubuntu 26.04 LTS: Rust Coreutils and sudo-rs](#ubuntu_2604_rust)
  * [Conclusion](#conclusion)
 
 -----------------------------------------
@@ -86,7 +87,7 @@ You can configure the stock `ubuntu` image yourself from your Dockerfile, so why
 
 | Component        | Why is it included? / Remarks |
 | ---------------- | ------------------- |
-| Ubuntu 26.04 LTS (Resolute) or 24.04 LTS (Noble) | The base system. Ubuntu 26.04 "Resolute" is the latest LTS; 24.04 "Noble" and 22.04 "Jammy" tracks are also maintained. |
+| Ubuntu 26.04 LTS (Resolute) or 24.04 LTS (Noble) | The base system. Ubuntu 26.04 "Resolute" is the latest LTS; 24.04 "Noble" and 22.04 "Jammy" tracks are also maintained. **Note:** Ubuntu 26.04 ships [Rust Coreutils (uutils-coreutils)](#ubuntu_2604_rust) instead of GNU Coreutils, and [sudo-rs](#ubuntu_2604_rust) instead of traditional sudo. See the [dedicated section](#ubuntu_2604_rust) for details and alternatives. |
 | A **correct** init process | _Main article: [Docker and the PID 1 zombie reaping problem](http://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping-problem/)._ <br><br>According to the Unix process model, [the init process](https://en.wikipedia.org/wiki/Init) -- PID 1 -- inherits all [orphaned child processes](https://en.wikipedia.org/wiki/Orphan_process) and must [reap them](https://en.wikipedia.org/wiki/Wait_(system_call)). Most Docker containers do not have an init process that does this correctly. As a result, their containers become filled with [zombie processes](https://en.wikipedia.org/wiki/Zombie_process) over time. <br><br>Furthermore, `docker stop` sends SIGTERM to the init process, which stops all services. Unfortunately most init systems don't do this correctly within Docker since they're built for hardware shutdowns instead. This causes processes to be hard killed with SIGKILL, which doesn't give them a chance to correctly deinitialize things. This can cause file corruption. <br><br>Baseimage-docker comes with an init process `/sbin/my_init` that performs both of these tasks correctly. |
 | Fixes APT incompatibilities with Docker | See https://github.com/dotcloud/docker/issues/1024. |
 | syslog-ng | A syslog daemon is necessary so that many services - including the kernel itself - can correctly log to /var/log/syslog. If no syslog daemon is running, a lot of important messages are silently swallowed. <br><br>Only listens locally. All syslog messages are forwarded to "docker logs".<br><br>Why syslog-ng?<br>I've had bad experience with rsyslog. I regularly run into bugs with rsyslog, and once in a while it takes my log host down by entering a 100% CPU loop in which it can't do anything. Syslog-ng seems to be much more stable. |
@@ -636,6 +637,61 @@ You can also set them directly as shown in the following example, to prevent `ss
 
 Then you can proceed with `make build` command.
 
+<a name="ubuntu_2604_rust"></a>
+### Ubuntu 26.04 LTS: Rust Coreutils and sudo-rs
+
+Ubuntu 26.04 LTS "Resolute Ringtail" introduced two significant changes compared to earlier Ubuntu releases:
+
+1. **Rust Coreutils (`uutils-coreutils`)** — Ubuntu 26.04 ships [uutils-coreutils](https://github.com/uutils/coreutils), a Rust-based reimplementation of the GNU Core Utilities (`ls`, `cp`, `mv`, `cat`, etc.), as the default `coreutils` package. This replaces the traditional [GNU Coreutils](https://www.gnu.org/software/coreutils/).
+
+2. **sudo-rs** — Ubuntu 26.04 ships [sudo-rs](https://github.com/trifectatechfoundation/sudo-rs), a memory-safe Rust reimplementation of `sudo`, as the default `sudo` provider.
+
+#### Why this matters
+
+| Concern | Details |
+|---------|---------|
+| **Compatibility** | `uutils-coreutils` aims for GNU Coreutils compatibility but may have subtle behavioral differences that can break scripts relying on specific GNU flags or output formats. Test your Dockerfiles and scripts carefully when upgrading to the 26.04 base image. |
+| **Security** | Rust's memory-safety guarantees eliminate whole classes of memory-related vulnerabilities (buffer overflows, use-after-free, etc.). This is generally considered an improvement for security. However, the Rust implementations are newer and have had less real-world exposure than their GNU counterparts. |
+| **Licensing** | Both `uutils-coreutils` and `sudo-rs` are licensed under the **MIT license**, whereas GNU Coreutils is **GPL-3.0** and traditional `sudo` is **ISC/BSD**. Users or organizations with specific license requirements should review these changes. |
+| **Maturity** | `uutils-coreutils` and `sudo-rs` are newer projects. Some edge cases, rarely-used options, or locale-sensitive behavior may differ from the GNU originals. |
+
+#### Alternatives
+
+**Option 1: Use the Ubuntu 24.04 LTS base image (recommended if you need GNU tooling)**
+
+The 24.04 "Noble Numbat" track is fully supported and ships GNU Coreutils and traditional `sudo`:
+
+```Dockerfile
+FROM phusion/baseimage:noble-1.0.2
+```
+
+Or build the image yourself targeting Ubuntu 24.04:
+
+```bash
+make build BASE_IMAGE=ubuntu:24.04
+```
+
+**Option 2: Replace Rust Coreutils with GNU Coreutils on Ubuntu 26.04**
+
+When building baseimage-docker from source, you can set `INSTALL_GNU_COREUTILS=1` to replace `uutils-coreutils` with GNU Coreutils and `sudo-rs` with traditional `sudo`:
+
+```bash
+docker build --build-arg BASE_IMAGE=ubuntu:26.04 --build-arg INSTALL_GNU_COREUTILS=1 image/
+```
+
+Alternatively, you can install GNU Coreutils in your own Dockerfile that derives from a 26.04-based baseimage:
+
+```Dockerfile
+FROM phusion/baseimage:resolute-1.0.0
+
+# Replace uutils-coreutils with GNU Coreutils and sudo-rs with traditional sudo.
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends coreutils-gnu sudo-traditional && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+```
+
+> **Note:** The exact replacement package names (`coreutils-gnu`, `sudo-traditional`) may vary. Run `apt-cache search coreutils` and `apt-cache search sudo` inside an Ubuntu 26.04 container to discover the available alternatives.
+
 <a name="conclusion"></a>
 ## Conclusion
 

image/Dockerfile

@@ -4,6 +4,11 @@ FROM $BASE_IMAGE
 ARG QEMU_ARCH
 #ADD x86_64_qemu-${QEMU_ARCH}-static.tar.gz /usr/bin
 
+# Ubuntu 26.04+ ships uutils-coreutils (Rust) and sudo-rs (Rust) by default.
+# Set INSTALL_GNU_COREUTILS=1 to replace them with GNU Coreutils and
+# traditional sudo. Has no effect on Ubuntu releases prior to 26.04.
+ARG INSTALL_GNU_COREUTILS=0
+
 COPY . /bd_build
 
 RUN /bd_build/prepare.sh && \

image/buildconfig

@@ -7,3 +7,8 @@ minimal_apt_get_install='apt-get install -y --no-install-recommends'
 export DISABLE_SYSLOG=${DISABLE_SYSLOG:-0}
 export DISABLE_SSH=${DISABLE_SSH:-0}
 export DISABLE_CRON=${DISABLE_CRON:-0}
+
+# Ubuntu 26.04+ ships uutils-coreutils (Rust) and sudo-rs (Rust) by default.
+# Set INSTALL_GNU_COREUTILS=1 to replace them with GNU Coreutils and
+# traditional sudo. Has no effect on Ubuntu releases prior to 26.04.
+export INSTALL_GNU_COREUTILS=${INSTALL_GNU_COREUTILS:-0}

image/prepare.sh

@@ -55,6 +55,34 @@ $minimal_apt_get_install software-properties-common
 ## Upgrade all packages.
 apt-get dist-upgrade -y --no-install-recommends -o Dpkg::Options::="--force-confold"
 
+## Ubuntu 26.04+ ships uutils-coreutils (Rust) and sudo-rs (Rust) by default.
+## Optionally replace them with GNU Coreutils and traditional sudo when
+## INSTALL_GNU_COREUTILS=1 is set at build time.
+if grep -E '^ID=' /etc/os-release | grep -q ubuntu; then
+  UBUNTU_VERSION=$(grep '^VERSION_ID=' /etc/os-release | cut -d'"' -f2)
+  if dpkg --compare-versions "$UBUNTU_VERSION" ge "26.04" 2>/dev/null; then
+    if [ "${INSTALL_GNU_COREUTILS:-0}" -eq 1 ]; then
+      echo "*** Installing GNU Coreutils and traditional sudo to replace Rust variants..."
+      # Install GNU Coreutils if available (package name may vary by Ubuntu release).
+      # 'coreutils-gnu' is the expected package name for the GNU implementation
+      # when uutils-coreutils is the default.
+      if apt-cache show coreutils-gnu > /dev/null 2>&1; then
+        $minimal_apt_get_install coreutils-gnu
+      fi
+      # Install traditional sudo if available (package name may vary).
+      # 'sudo-traditional' or similar may be provided alongside 'sudo-rs'.
+      if apt-cache show sudo-traditional > /dev/null 2>&1; then
+        $minimal_apt_get_install sudo-traditional
+      elif apt-cache show sudo-classic > /dev/null 2>&1; then
+        $minimal_apt_get_install sudo-classic
+      fi
+    else
+      echo "*** Ubuntu 26.04 detected: using default uutils-coreutils (Rust) and sudo-rs (Rust)."
+      echo "*** Set INSTALL_GNU_COREUTILS=1 at build time to use GNU Coreutils and traditional sudo instead."
+    fi
+  fi
+fi
+
 ## Fix locale.
 case $(lsb_release -is) in
   Ubuntu)