From 169e147321f3e081b6b51a32e0840ed3ab73f9a9 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 18 May 2026 20:46:06 +0000 Subject: [PATCH 01/11] Initial plan From 1a930ec9557f0b51d3e842aced36f257f94efece Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 18 May 2026 20:50:29 +0000 Subject: [PATCH 02/11] docs: document Ubuntu 26.04 Rust Coreutils and sudo-rs, add INSTALL_GNU_COREUTILS build flag Agent-Logs-Url: https://github.com/phusion/baseimage-docker/sessions/065ff4d3-d584-4cb8-8265-5d1f0f7dc3b1 Co-authored-by: Theaxiom <57013+Theaxiom@users.noreply.github.com> --- README.md | 60 +++++++++++++++++++++++++++++++++++++++++++++-- image/Dockerfile | 5 ++++ image/buildconfig | 5 ++++ image/prepare.sh | 28 ++++++++++++++++++++++ 4 files changed, 96 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 3bd71e4..07fcaed 100644 --- a/README.md +++ b/README.md @@ -71,7 +71,8 @@ You can configure the stock `ubuntu` image yourself from your Dockerfile, so why * [Using your own key](#using_your_own_key) * [The `docker-ssh` tool](#docker_ssh) * [Building the image yourself](#building) - * [Removing optional services](#removing_optional_services) + * [Removing optional services](#removing_optional_services) + * [Ubuntu 26.04 LTS: Rust Coreutils and sudo-rs](#ubuntu_2604_rust) * [Conclusion](#conclusion) ----------------------------------------- @@ -86,7 +87,7 @@ You can configure the stock `ubuntu` image yourself from your Dockerfile, so why | Component | Why is it included? / Remarks | | ---------------- | ------------------- | -| Ubuntu 26.04 LTS (Resolute) or 24.04 LTS (Noble) | The base system. Ubuntu 26.04 "Resolute" is the latest LTS; 24.04 "Noble" and 22.04 "Jammy" tracks are also maintained. | +| Ubuntu 26.04 LTS (Resolute) or 24.04 LTS (Noble) | The base system. Ubuntu 26.04 "Resolute" is the latest LTS; 24.04 "Noble" and 22.04 "Jammy" tracks are also maintained. **Note:** Ubuntu 26.04 ships [Rust Coreutils (uutils-coreutils)](#ubuntu_2604_rust) instead of GNU Coreutils, and [sudo-rs](#ubuntu_2604_rust) instead of traditional sudo. See the [dedicated section](#ubuntu_2604_rust) for details and alternatives. | | A **correct** init process | _Main article: [Docker and the PID 1 zombie reaping problem](http://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping-problem/)._

According to the Unix process model, [the init process](https://en.wikipedia.org/wiki/Init) -- PID 1 -- inherits all [orphaned child processes](https://en.wikipedia.org/wiki/Orphan_process) and must [reap them](https://en.wikipedia.org/wiki/Wait_(system_call)). Most Docker containers do not have an init process that does this correctly. As a result, their containers become filled with [zombie processes](https://en.wikipedia.org/wiki/Zombie_process) over time.

Furthermore, `docker stop` sends SIGTERM to the init process, which stops all services. Unfortunately most init systems don't do this correctly within Docker since they're built for hardware shutdowns instead. This causes processes to be hard killed with SIGKILL, which doesn't give them a chance to correctly deinitialize things. This can cause file corruption.

Baseimage-docker comes with an init process `/sbin/my_init` that performs both of these tasks correctly. | | Fixes APT incompatibilities with Docker | See https://github.com/dotcloud/docker/issues/1024. | | syslog-ng | A syslog daemon is necessary so that many services - including the kernel itself - can correctly log to /var/log/syslog. If no syslog daemon is running, a lot of important messages are silently swallowed.

Only listens locally. All syslog messages are forwarded to "docker logs".

Why syslog-ng?
I've had bad experience with rsyslog. I regularly run into bugs with rsyslog, and once in a while it takes my log host down by entering a 100% CPU loop in which it can't do anything. Syslog-ng seems to be much more stable. | @@ -636,6 +637,61 @@ You can also set them directly as shown in the following example, to prevent `ss Then you can proceed with `make build` command. + +### Ubuntu 26.04 LTS: Rust Coreutils and sudo-rs + +Ubuntu 26.04 LTS "Resolute Ringtail" introduced two significant changes compared to earlier Ubuntu releases: + +1. **Rust Coreutils (`uutils-coreutils`)** — Ubuntu 26.04 ships [uutils-coreutils](https://github.com/uutils/coreutils), a Rust-based reimplementation of the GNU Core Utilities (`ls`, `cp`, `mv`, `cat`, etc.), as the default `coreutils` package. This replaces the traditional [GNU Coreutils](https://www.gnu.org/software/coreutils/). + +2. **sudo-rs** — Ubuntu 26.04 ships [sudo-rs](https://github.com/trifectatechfoundation/sudo-rs), a memory-safe Rust reimplementation of `sudo`, as the default `sudo` provider. + +#### Why this matters + +| Concern | Details | +|---------|---------| +| **Compatibility** | `uutils-coreutils` aims for GNU Coreutils compatibility but may have subtle behavioral differences that can break scripts relying on specific GNU flags or output formats. Test your Dockerfiles and scripts carefully when upgrading to the 26.04 base image. | +| **Security** | Rust's memory-safety guarantees eliminate whole classes of memory-related vulnerabilities (buffer overflows, use-after-free, etc.). This is generally considered an improvement for security. However, the Rust implementations are newer and have had less real-world exposure than their GNU counterparts. | +| **Licensing** | Both `uutils-coreutils` and `sudo-rs` are licensed under the **MIT license**, whereas GNU Coreutils is **GPL-3.0** and traditional `sudo` is **ISC/BSD**. Users or organizations with specific license requirements should review these changes. | +| **Maturity** | `uutils-coreutils` and `sudo-rs` are newer projects. Some edge cases, rarely-used options, or locale-sensitive behavior may differ from the GNU originals. | + +#### Alternatives + +**Option 1: Use the Ubuntu 24.04 LTS base image (recommended if you need GNU tooling)** + +The 24.04 "Noble Numbat" track is fully supported and ships GNU Coreutils and traditional `sudo`: + +```Dockerfile +FROM phusion/baseimage:noble-1.0.2 +``` + +Or build the image yourself targeting Ubuntu 24.04: + +```bash +make build BASE_IMAGE=ubuntu:24.04 +``` + +**Option 2: Replace Rust Coreutils with GNU Coreutils on Ubuntu 26.04** + +When building baseimage-docker from source, you can set `INSTALL_GNU_COREUTILS=1` to replace `uutils-coreutils` with GNU Coreutils and `sudo-rs` with traditional `sudo`: + +```bash +docker build --build-arg BASE_IMAGE=ubuntu:26.04 --build-arg INSTALL_GNU_COREUTILS=1 image/ +``` + +Alternatively, you can install GNU Coreutils in your own Dockerfile that derives from a 26.04-based baseimage: + +```Dockerfile +FROM phusion/baseimage:resolute-1.0.0 + +# Replace uutils-coreutils with GNU Coreutils and sudo-rs with traditional sudo. +RUN apt-get update && \ + apt-get install -y --no-install-recommends coreutils-gnu sudo-traditional && \ + apt-get clean && rm -rf /var/lib/apt/lists/* +``` + +> **Note:** The exact replacement package names (`coreutils-gnu`, `sudo-traditional`) may vary. Run `apt-cache search coreutils` and `apt-cache search sudo` inside an Ubuntu 26.04 container to discover the available alternatives. + ## Conclusion diff --git a/image/Dockerfile b/image/Dockerfile index 0c03458..7f2d70a 100644 --- a/image/Dockerfile +++ b/image/Dockerfile @@ -4,6 +4,11 @@ FROM $BASE_IMAGE ARG QEMU_ARCH #ADD x86_64_qemu-${QEMU_ARCH}-static.tar.gz /usr/bin +# Ubuntu 26.04+ ships uutils-coreutils (Rust) and sudo-rs (Rust) by default. +# Set INSTALL_GNU_COREUTILS=1 to replace them with GNU Coreutils and +# traditional sudo. Has no effect on Ubuntu releases prior to 26.04. +ARG INSTALL_GNU_COREUTILS=0 + COPY . /bd_build RUN /bd_build/prepare.sh && \ diff --git a/image/buildconfig b/image/buildconfig index 564c510..36e45f8 100644 --- a/image/buildconfig +++ b/image/buildconfig @@ -7,3 +7,8 @@ minimal_apt_get_install='apt-get install -y --no-install-recommends' export DISABLE_SYSLOG=${DISABLE_SYSLOG:-0} export DISABLE_SSH=${DISABLE_SSH:-0} export DISABLE_CRON=${DISABLE_CRON:-0} + +# Ubuntu 26.04+ ships uutils-coreutils (Rust) and sudo-rs (Rust) by default. +# Set INSTALL_GNU_COREUTILS=1 to replace them with GNU Coreutils and +# traditional sudo. Has no effect on Ubuntu releases prior to 26.04. +export INSTALL_GNU_COREUTILS=${INSTALL_GNU_COREUTILS:-0} diff --git a/image/prepare.sh b/image/prepare.sh index f2a790d..07d37cf 100755 --- a/image/prepare.sh +++ b/image/prepare.sh @@ -55,6 +55,34 @@ $minimal_apt_get_install software-properties-common ## Upgrade all packages. apt-get dist-upgrade -y --no-install-recommends -o Dpkg::Options::="--force-confold" +## Ubuntu 26.04+ ships uutils-coreutils (Rust) and sudo-rs (Rust) by default. +## Optionally replace them with GNU Coreutils and traditional sudo when +## INSTALL_GNU_COREUTILS=1 is set at build time. +if grep -E '^ID=' /etc/os-release | grep -q ubuntu; then + UBUNTU_VERSION=$(grep '^VERSION_ID=' /etc/os-release | cut -d'"' -f2) + if dpkg --compare-versions "$UBUNTU_VERSION" ge "26.04" 2>/dev/null; then + if [ "${INSTALL_GNU_COREUTILS:-0}" -eq 1 ]; then + echo "*** Installing GNU Coreutils and traditional sudo to replace Rust variants..." + # Install GNU Coreutils if available (package name may vary by Ubuntu release). + # 'coreutils-gnu' is the expected package name for the GNU implementation + # when uutils-coreutils is the default. + if apt-cache show coreutils-gnu > /dev/null 2>&1; then + $minimal_apt_get_install coreutils-gnu + fi + # Install traditional sudo if available (package name may vary). + # 'sudo-traditional' or similar may be provided alongside 'sudo-rs'. + if apt-cache show sudo-traditional > /dev/null 2>&1; then + $minimal_apt_get_install sudo-traditional + elif apt-cache show sudo-classic > /dev/null 2>&1; then + $minimal_apt_get_install sudo-classic + fi + else + echo "*** Ubuntu 26.04 detected: using default uutils-coreutils (Rust) and sudo-rs (Rust)." + echo "*** Set INSTALL_GNU_COREUTILS=1 at build time to use GNU Coreutils and traditional sudo instead." + fi + fi +fi + ## Fix locale. case $(lsb_release -is) in Ubuntu) From 1fb3ce0c68e08dddffc1437a46593c99d17a6343 Mon Sep 17 00:00:00 2001 From: Jeshua Ben Joseph Date: Mon, 18 May 2026 13:57:19 -0700 Subject: [PATCH 03/11] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- image/prepare.sh | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/image/prepare.sh b/image/prepare.sh index 07d37cf..7af12a0 100755 --- a/image/prepare.sh +++ b/image/prepare.sh @@ -63,18 +63,33 @@ if grep -E '^ID=' /etc/os-release | grep -q ubuntu; then if dpkg --compare-versions "$UBUNTU_VERSION" ge "26.04" 2>/dev/null; then if [ "${INSTALL_GNU_COREUTILS:-0}" -eq 1 ]; then echo "*** Installing GNU Coreutils and traditional sudo to replace Rust variants..." + GNU_COREUTILS_INSTALLED=0 + TRADITIONAL_SUDO_INSTALLED=0 # Install GNU Coreutils if available (package name may vary by Ubuntu release). # 'coreutils-gnu' is the expected package name for the GNU implementation # when uutils-coreutils is the default. if apt-cache show coreutils-gnu > /dev/null 2>&1; then $minimal_apt_get_install coreutils-gnu + GNU_COREUTILS_INSTALLED=1 fi # Install traditional sudo if available (package name may vary). # 'sudo-traditional' or similar may be provided alongside 'sudo-rs'. if apt-cache show sudo-traditional > /dev/null 2>&1; then $minimal_apt_get_install sudo-traditional + TRADITIONAL_SUDO_INSTALLED=1 elif apt-cache show sudo-classic > /dev/null 2>&1; then $minimal_apt_get_install sudo-classic + TRADITIONAL_SUDO_INSTALLED=1 + fi + if [ "$GNU_COREUTILS_INSTALLED" -ne 1 ] || [ "$TRADITIONAL_SUDO_INSTALLED" -ne 1 ]; then + echo "*** ERROR: INSTALL_GNU_COREUTILS=1 was requested, but the requested replacements could not be fully installed." >&2 + if [ "$GNU_COREUTILS_INSTALLED" -ne 1 ]; then + echo "*** ERROR: No GNU coreutils replacement package was found (tried: coreutils-gnu)." >&2 + fi + if [ "$TRADITIONAL_SUDO_INSTALLED" -ne 1 ]; then + echo "*** ERROR: No traditional sudo replacement package was found (tried: sudo-traditional, sudo-classic)." >&2 + fi + exit 1 fi else echo "*** Ubuntu 26.04 detected: using default uutils-coreutils (Rust) and sudo-rs (Rust)." From e08fc42a891b04cb376031f7fc45b0910dfdce67 Mon Sep 17 00:00:00 2001 From: Jeshua Ben Joseph Date: Mon, 18 May 2026 13:57:31 -0700 Subject: [PATCH 04/11] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- image/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image/Dockerfile b/image/Dockerfile index 7f2d70a..9ec4068 100644 --- a/image/Dockerfile +++ b/image/Dockerfile @@ -11,7 +11,7 @@ ARG INSTALL_GNU_COREUTILS=0 COPY . /bd_build -RUN /bd_build/prepare.sh && \ +RUN INSTALL_GNU_COREUTILS=$INSTALL_GNU_COREUTILS /bd_build/prepare.sh && \ /bd_build/system_services.sh && \ /bd_build/utilities.sh && \ /bd_build/cleanup.sh From 9e1c46489b4e433a3af8e3346607a2a6fc5c5a7c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 18 May 2026 21:00:15 +0000 Subject: [PATCH 05/11] fix: address review feedback on prepare.sh verification and README codename Agent-Logs-Url: https://github.com/phusion/baseimage-docker/sessions/f25d0dfd-2691-466f-8dcc-1075a4824daf Co-authored-by: Theaxiom <57013+Theaxiom@users.noreply.github.com> --- README.md | 4 ++-- image/prepare.sh | 12 ++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 07fcaed..bdf4901 100644 --- a/README.md +++ b/README.md @@ -640,7 +640,7 @@ Then you can proceed with `make build` command. ### Ubuntu 26.04 LTS: Rust Coreutils and sudo-rs -Ubuntu 26.04 LTS "Resolute Ringtail" introduced two significant changes compared to earlier Ubuntu releases: +Ubuntu 26.04 LTS introduced two significant changes compared to earlier Ubuntu releases: 1. **Rust Coreutils (`uutils-coreutils`)** — Ubuntu 26.04 ships [uutils-coreutils](https://github.com/uutils/coreutils), a Rust-based reimplementation of the GNU Core Utilities (`ls`, `cp`, `mv`, `cat`, etc.), as the default `coreutils` package. This replaces the traditional [GNU Coreutils](https://www.gnu.org/software/coreutils/). @@ -682,7 +682,7 @@ docker build --build-arg BASE_IMAGE=ubuntu:26.04 --build-arg INSTALL_GNU_COREUTI Alternatively, you can install GNU Coreutils in your own Dockerfile that derives from a 26.04-based baseimage: ```Dockerfile -FROM phusion/baseimage:resolute-1.0.0 +FROM phusion/baseimage: # Replace uutils-coreutils with GNU Coreutils and sudo-rs with traditional sudo. RUN apt-get update && \ diff --git a/image/prepare.sh b/image/prepare.sh index 7af12a0..966b7c3 100755 --- a/image/prepare.sh +++ b/image/prepare.sh @@ -91,6 +91,18 @@ if grep -E '^ID=' /etc/os-release | grep -q ubuntu; then fi exit 1 fi + # Verify that GNU coreutils are now the active implementation on PATH. + # Some packages may install binaries under a non-default path and rely on + # update-alternatives; if so the replacement has not taken effect. + if ! ls --version 2>&1 | grep -qi 'gnu coreutils'; then + echo "*** ERROR: coreutils-gnu was installed but GNU coreutils are not active on PATH." >&2 + echo "*** 'ls --version' does not report 'GNU coreutils'." >&2 + echo "*** The package may place binaries outside the default PATH or require" >&2 + echo "*** manual update-alternatives configuration. Check Ubuntu 26.04 packaging." >&2 + exit 1 + fi + LS_VER=$(ls --version | head -1) + echo "*** GNU Coreutils are active ($LS_VER)." else echo "*** Ubuntu 26.04 detected: using default uutils-coreutils (Rust) and sudo-rs (Rust)." echo "*** Set INSTALL_GNU_COREUTILS=1 at build time to use GNU Coreutils and traditional sudo instead." From 86c83533b654dba09e31cdeac47d6b717bcbef8a Mon Sep 17 00:00:00 2001 From: Jeshua Ben Joseph Date: Mon, 18 May 2026 14:10:38 -0700 Subject: [PATCH 06/11] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- image/prepare.sh | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/image/prepare.sh b/image/prepare.sh index 966b7c3..0bf5875 100755 --- a/image/prepare.sh +++ b/image/prepare.sh @@ -61,7 +61,17 @@ apt-get dist-upgrade -y --no-install-recommends -o Dpkg::Options::="--force-conf if grep -E '^ID=' /etc/os-release | grep -q ubuntu; then UBUNTU_VERSION=$(grep '^VERSION_ID=' /etc/os-release | cut -d'"' -f2) if dpkg --compare-versions "$UBUNTU_VERSION" ge "26.04" 2>/dev/null; then - if [ "${INSTALL_GNU_COREUTILS:-0}" -eq 1 ]; then + case "${INSTALL_GNU_COREUTILS:-0}" in + 0|1) + INSTALL_GNU_COREUTILS_NORMALIZED="${INSTALL_GNU_COREUTILS:-0}" + ;; + *) + echo "*** Invalid value for INSTALL_GNU_COREUTILS: '${INSTALL_GNU_COREUTILS}'" >&2 + echo "*** Expected 0 or 1." >&2 + exit 1 + ;; + esac + if [ "$INSTALL_GNU_COREUTILS_NORMALIZED" = "1" ]; then echo "*** Installing GNU Coreutils and traditional sudo to replace Rust variants..." GNU_COREUTILS_INSTALLED=0 TRADITIONAL_SUDO_INSTALLED=0 From af5f71b4d47ef155f4c078809ffba5c93e0f9c2a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 20 May 2026 03:51:28 +0000 Subject: [PATCH 07/11] docs: rewrite speculative Dockerfile snippet with apt-cache discovery step Agent-Logs-Url: https://github.com/phusion/baseimage-docker/sessions/dda28199-53b3-47bb-acf4-8aec529f3e22 Co-authored-by: Theaxiom <57013+Theaxiom@users.noreply.github.com> --- README.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index bdf4901..8d7a0c7 100644 --- a/README.md +++ b/README.md @@ -679,19 +679,27 @@ When building baseimage-docker from source, you can set `INSTALL_GNU_COREUTILS=1 docker build --build-arg BASE_IMAGE=ubuntu:26.04 --build-arg INSTALL_GNU_COREUTILS=1 image/ ``` -Alternatively, you can install GNU Coreutils in your own Dockerfile that derives from a 26.04-based baseimage: +Alternatively, you can install GNU Coreutils in your own Dockerfile that derives from a 26.04-based baseimage. Because Ubuntu 26.04 packaging is not yet finalised, first discover the correct package names: + +```bash +# Discover available GNU coreutils and traditional sudo packages on Ubuntu 26.04: +docker run --rm ubuntu:26.04 sh -c \ + 'apt-get update -qq && apt-cache search coreutils && apt-cache search sudo | grep -i traditional' +``` + +Once you have confirmed the actual package names, install them in your Dockerfile: ```Dockerfile FROM phusion/baseimage: # Replace uutils-coreutils with GNU Coreutils and sudo-rs with traditional sudo. +# Substitute and with the actual +# package names found via 'apt-cache search' on Ubuntu 26.04 above. RUN apt-get update && \ - apt-get install -y --no-install-recommends coreutils-gnu sudo-traditional && \ + apt-get install -y --no-install-recommends && \ apt-get clean && rm -rf /var/lib/apt/lists/* ``` -> **Note:** The exact replacement package names (`coreutils-gnu`, `sudo-traditional`) may vary. Run `apt-cache search coreutils` and `apt-cache search sudo` inside an Ubuntu 26.04 container to discover the available alternatives. - ## Conclusion From 785d124a701e6e9c507a7b5a05258a4a8538fa8e Mon Sep 17 00:00:00 2001 From: PikachuEXE Date: Wed, 20 May 2026 16:12:29 +0800 Subject: [PATCH 08/11] Update scripts to really replace rust coreutils with GNU coreutils --- image/Dockerfile | 6 +++--- image/buildconfig | 6 +++--- image/prepare.sh | 42 ++++++++---------------------------------- 3 files changed, 14 insertions(+), 40 deletions(-) diff --git a/image/Dockerfile b/image/Dockerfile index 9ec4068..891fa26 100644 --- a/image/Dockerfile +++ b/image/Dockerfile @@ -4,9 +4,9 @@ FROM $BASE_IMAGE ARG QEMU_ARCH #ADD x86_64_qemu-${QEMU_ARCH}-static.tar.gz /usr/bin -# Ubuntu 26.04+ ships uutils-coreutils (Rust) and sudo-rs (Rust) by default. -# Set INSTALL_GNU_COREUTILS=1 to replace them with GNU Coreutils and -# traditional sudo. Has no effect on Ubuntu releases prior to 26.04. +# Ubuntu 26.04+ ships uutils-coreutils (Rust) by default. +# Set INSTALL_GNU_COREUTILS=1 to replace them with GNU Coreutils. +# Has no effect on Ubuntu releases prior to 26.04. ARG INSTALL_GNU_COREUTILS=0 COPY . /bd_build diff --git a/image/buildconfig b/image/buildconfig index 36e45f8..a899950 100644 --- a/image/buildconfig +++ b/image/buildconfig @@ -8,7 +8,7 @@ export DISABLE_SYSLOG=${DISABLE_SYSLOG:-0} export DISABLE_SSH=${DISABLE_SSH:-0} export DISABLE_CRON=${DISABLE_CRON:-0} -# Ubuntu 26.04+ ships uutils-coreutils (Rust) and sudo-rs (Rust) by default. -# Set INSTALL_GNU_COREUTILS=1 to replace them with GNU Coreutils and -# traditional sudo. Has no effect on Ubuntu releases prior to 26.04. +# Ubuntu 26.04+ ships uutils-coreutils (Rust) by default. +# Set INSTALL_GNU_COREUTILS=1 to replace them with GNU Coreutils. +# Has no effect on Ubuntu releases prior to 26.04. export INSTALL_GNU_COREUTILS=${INSTALL_GNU_COREUTILS:-0} diff --git a/image/prepare.sh b/image/prepare.sh index 0bf5875..e3bd380 100755 --- a/image/prepare.sh +++ b/image/prepare.sh @@ -55,8 +55,8 @@ $minimal_apt_get_install software-properties-common ## Upgrade all packages. apt-get dist-upgrade -y --no-install-recommends -o Dpkg::Options::="--force-confold" -## Ubuntu 26.04+ ships uutils-coreutils (Rust) and sudo-rs (Rust) by default. -## Optionally replace them with GNU Coreutils and traditional sudo when +## Ubuntu 26.04+ ships uutils-coreutils (Rust) by default. +## Optionally replace them with GNU Coreutils when ## INSTALL_GNU_COREUTILS=1 is set at build time. if grep -E '^ID=' /etc/os-release | grep -q ubuntu; then UBUNTU_VERSION=$(grep '^VERSION_ID=' /etc/os-release | cut -d'"' -f2) @@ -72,40 +72,14 @@ if grep -E '^ID=' /etc/os-release | grep -q ubuntu; then ;; esac if [ "$INSTALL_GNU_COREUTILS_NORMALIZED" = "1" ]; then - echo "*** Installing GNU Coreutils and traditional sudo to replace Rust variants..." - GNU_COREUTILS_INSTALLED=0 - TRADITIONAL_SUDO_INSTALLED=0 - # Install GNU Coreutils if available (package name may vary by Ubuntu release). - # 'coreutils-gnu' is the expected package name for the GNU implementation - # when uutils-coreutils is the default. - if apt-cache show coreutils-gnu > /dev/null 2>&1; then - $minimal_apt_get_install coreutils-gnu - GNU_COREUTILS_INSTALLED=1 - fi - # Install traditional sudo if available (package name may vary). - # 'sudo-traditional' or similar may be provided alongside 'sudo-rs'. - if apt-cache show sudo-traditional > /dev/null 2>&1; then - $minimal_apt_get_install sudo-traditional - TRADITIONAL_SUDO_INSTALLED=1 - elif apt-cache show sudo-classic > /dev/null 2>&1; then - $minimal_apt_get_install sudo-classic - TRADITIONAL_SUDO_INSTALLED=1 - fi - if [ "$GNU_COREUTILS_INSTALLED" -ne 1 ] || [ "$TRADITIONAL_SUDO_INSTALLED" -ne 1 ]; then - echo "*** ERROR: INSTALL_GNU_COREUTILS=1 was requested, but the requested replacements could not be fully installed." >&2 - if [ "$GNU_COREUTILS_INSTALLED" -ne 1 ]; then - echo "*** ERROR: No GNU coreutils replacement package was found (tried: coreutils-gnu)." >&2 - fi - if [ "$TRADITIONAL_SUDO_INSTALLED" -ne 1 ]; then - echo "*** ERROR: No traditional sudo replacement package was found (tried: sudo-traditional, sudo-classic)." >&2 - fi - exit 1 - fi + echo "*** Removing Rust to restore GNU Coreutils..." + # GNU Coreutils can only be installed by removing `coreutils-from-uutils` + apt-get remove -y --allow-remove-essential coreutils-from-uutils # Verify that GNU coreutils are now the active implementation on PATH. # Some packages may install binaries under a non-default path and rely on # update-alternatives; if so the replacement has not taken effect. if ! ls --version 2>&1 | grep -qi 'gnu coreutils'; then - echo "*** ERROR: coreutils-gnu was installed but GNU coreutils are not active on PATH." >&2 + echo "*** ERROR: coreutils-from-gnu was installed but GNU coreutils are not active on PATH." >&2 echo "*** 'ls --version' does not report 'GNU coreutils'." >&2 echo "*** The package may place binaries outside the default PATH or require" >&2 echo "*** manual update-alternatives configuration. Check Ubuntu 26.04 packaging." >&2 @@ -114,8 +88,8 @@ if grep -E '^ID=' /etc/os-release | grep -q ubuntu; then LS_VER=$(ls --version | head -1) echo "*** GNU Coreutils are active ($LS_VER)." else - echo "*** Ubuntu 26.04 detected: using default uutils-coreutils (Rust) and sudo-rs (Rust)." - echo "*** Set INSTALL_GNU_COREUTILS=1 at build time to use GNU Coreutils and traditional sudo instead." + echo "*** Ubuntu 26.04 detected: using default uutils-coreutils (Rust)." + echo "*** Set INSTALL_GNU_COREUTILS=1 at build time to use GNU Coreutils instead." fi fi fi From 75806395032100c671a62d9e50a1e44efd7e715a Mon Sep 17 00:00:00 2001 From: PikachuEXE Date: Thu, 21 May 2026 08:50:31 +0800 Subject: [PATCH 09/11] ~ Update README to remove most reference to sudo --- README.md | 36 +++++++++++++----------------------- 1 file changed, 13 insertions(+), 23 deletions(-) diff --git a/README.md b/README.md index 8d7a0c7..c606759 100644 --- a/README.md +++ b/README.md @@ -72,7 +72,7 @@ You can configure the stock `ubuntu` image yourself from your Dockerfile, so why * [The `docker-ssh` tool](#docker_ssh) * [Building the image yourself](#building) * [Removing optional services](#removing_optional_services) - * [Ubuntu 26.04 LTS: Rust Coreutils and sudo-rs](#ubuntu_2604_rust) + * [Ubuntu 26.04 LTS: Rust Coreutils](#ubuntu_2604_rust) * [Conclusion](#conclusion) ----------------------------------------- @@ -87,7 +87,7 @@ You can configure the stock `ubuntu` image yourself from your Dockerfile, so why | Component | Why is it included? / Remarks | | ---------------- | ------------------- | -| Ubuntu 26.04 LTS (Resolute) or 24.04 LTS (Noble) | The base system. Ubuntu 26.04 "Resolute" is the latest LTS; 24.04 "Noble" and 22.04 "Jammy" tracks are also maintained. **Note:** Ubuntu 26.04 ships [Rust Coreutils (uutils-coreutils)](#ubuntu_2604_rust) instead of GNU Coreutils, and [sudo-rs](#ubuntu_2604_rust) instead of traditional sudo. See the [dedicated section](#ubuntu_2604_rust) for details and alternatives. | +| Ubuntu 26.04 LTS (Resolute) or 24.04 LTS (Noble) | The base system. Ubuntu 26.04 "Resolute" is the latest LTS; 24.04 "Noble" and 22.04 "Jammy" tracks are also maintained. **Note:** Ubuntu 26.04 ships [Rust Coreutils (uutils coreutils)](#ubuntu_2604_rust) instead of GNU Coreutils. See the [dedicated section](#ubuntu_2604_rust) for details and alternatives. | | A **correct** init process | _Main article: [Docker and the PID 1 zombie reaping problem](http://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping-problem/)._

According to the Unix process model, [the init process](https://en.wikipedia.org/wiki/Init) -- PID 1 -- inherits all [orphaned child processes](https://en.wikipedia.org/wiki/Orphan_process) and must [reap them](https://en.wikipedia.org/wiki/Wait_(system_call)). Most Docker containers do not have an init process that does this correctly. As a result, their containers become filled with [zombie processes](https://en.wikipedia.org/wiki/Zombie_process) over time.

Furthermore, `docker stop` sends SIGTERM to the init process, which stops all services. Unfortunately most init systems don't do this correctly within Docker since they're built for hardware shutdowns instead. This causes processes to be hard killed with SIGKILL, which doesn't give them a chance to correctly deinitialize things. This can cause file corruption.

Baseimage-docker comes with an init process `/sbin/my_init` that performs both of these tasks correctly. | | Fixes APT incompatibilities with Docker | See https://github.com/dotcloud/docker/issues/1024. | | syslog-ng | A syslog daemon is necessary so that many services - including the kernel itself - can correctly log to /var/log/syslog. If no syslog daemon is running, a lot of important messages are silently swallowed.

Only listens locally. All syslog messages are forwarded to "docker logs".

Why syslog-ng?
I've had bad experience with rsyslog. I regularly run into bugs with rsyslog, and once in a while it takes my log host down by entering a 100% CPU loop in which it can't do anything. Syslog-ng seems to be much more stable. | @@ -638,28 +638,28 @@ You can also set them directly as shown in the following example, to prevent `ss Then you can proceed with `make build` command. -### Ubuntu 26.04 LTS: Rust Coreutils and sudo-rs +### Ubuntu 26.04 LTS: Rust Coreutils Ubuntu 26.04 LTS introduced two significant changes compared to earlier Ubuntu releases: -1. **Rust Coreutils (`uutils-coreutils`)** — Ubuntu 26.04 ships [uutils-coreutils](https://github.com/uutils/coreutils), a Rust-based reimplementation of the GNU Core Utilities (`ls`, `cp`, `mv`, `cat`, etc.), as the default `coreutils` package. This replaces the traditional [GNU Coreutils](https://www.gnu.org/software/coreutils/). +1. **Rust Coreutils (`uutils coreutils`)** — Ubuntu 26.04 ships [uutils coreutils](https://github.com/uutils/coreutils), a Rust-based reimplementation of the GNU Core Utilities (`ls`, `cp`, `mv`, `cat`, etc.), as the default `coreutils` package. This replaces the traditional [GNU Coreutils](https://www.gnu.org/software/coreutils/). -2. **sudo-rs** — Ubuntu 26.04 ships [sudo-rs](https://github.com/trifectatechfoundation/sudo-rs), a memory-safe Rust reimplementation of `sudo`, as the default `sudo` provider. +2. **sudo-rs** — Ubuntu 26.04 ships [sudo-rs](https://github.com/trifectatechfoundation/sudo-rs), a memory-safe Rust reimplementation of `sudo`, as the default `sudo` provider. (This is absent in official Docker image) #### Why this matters | Concern | Details | |---------|---------| -| **Compatibility** | `uutils-coreutils` aims for GNU Coreutils compatibility but may have subtle behavioral differences that can break scripts relying on specific GNU flags or output formats. Test your Dockerfiles and scripts carefully when upgrading to the 26.04 base image. | +| **Compatibility** | `uutils coreutils` aims for GNU Coreutils compatibility but may have subtle behavioral differences that can break scripts relying on specific GNU flags or output formats. Test your Dockerfiles and scripts carefully when upgrading to the 26.04 base image. | | **Security** | Rust's memory-safety guarantees eliminate whole classes of memory-related vulnerabilities (buffer overflows, use-after-free, etc.). This is generally considered an improvement for security. However, the Rust implementations are newer and have had less real-world exposure than their GNU counterparts. | -| **Licensing** | Both `uutils-coreutils` and `sudo-rs` are licensed under the **MIT license**, whereas GNU Coreutils is **GPL-3.0** and traditional `sudo` is **ISC/BSD**. Users or organizations with specific license requirements should review these changes. | -| **Maturity** | `uutils-coreutils` and `sudo-rs` are newer projects. Some edge cases, rarely-used options, or locale-sensitive behavior may differ from the GNU originals. | +| **Licensing** | Both `uutils coreutils` is licensed under the **MIT license**, whereas GNU Coreutils is **GPL-3.0**. Users or organizations with specific license requirements should review these changes. | +| **Maturity** | `uutils coreutils` is a newer project. Some edge cases, rarely-used options, or locale-sensitive behavior may differ from the GNU originals. | #### Alternatives **Option 1: Use the Ubuntu 24.04 LTS base image (recommended if you need GNU tooling)** -The 24.04 "Noble Numbat" track is fully supported and ships GNU Coreutils and traditional `sudo`: +The 24.04 "Noble Numbat" track is fully supported and ships GNU Coreutils: ```Dockerfile FROM phusion/baseimage:noble-1.0.2 @@ -673,30 +673,20 @@ make build BASE_IMAGE=ubuntu:24.04 **Option 2: Replace Rust Coreutils with GNU Coreutils on Ubuntu 26.04** -When building baseimage-docker from source, you can set `INSTALL_GNU_COREUTILS=1` to replace `uutils-coreutils` with GNU Coreutils and `sudo-rs` with traditional `sudo`: +When building baseimage-docker from source, you can set `INSTALL_GNU_COREUTILS=1` to replace `uutils coreutils` with GNU Coreutils: ```bash docker build --build-arg BASE_IMAGE=ubuntu:26.04 --build-arg INSTALL_GNU_COREUTILS=1 image/ ``` -Alternatively, you can install GNU Coreutils in your own Dockerfile that derives from a 26.04-based baseimage. Because Ubuntu 26.04 packaging is not yet finalised, first discover the correct package names: - -```bash -# Discover available GNU coreutils and traditional sudo packages on Ubuntu 26.04: -docker run --rm ubuntu:26.04 sh -c \ - 'apt-get update -qq && apt-cache search coreutils && apt-cache search sudo | grep -i traditional' -``` - -Once you have confirmed the actual package names, install them in your Dockerfile: +Alternatively, you can install GNU Coreutils in your own Dockerfile that derives from a 26.04-based baseimage by removing `uutils coreutils`: ```Dockerfile FROM phusion/baseimage: -# Replace uutils-coreutils with GNU Coreutils and sudo-rs with traditional sudo. -# Substitute and with the actual -# package names found via 'apt-cache search' on Ubuntu 26.04 above. +# Replace uutils coreutils with GNU Coreutils. RUN apt-get update && \ - apt-get install -y --no-install-recommends && \ + apt-get remove -y --allow-remove-essential coreutils-from-uutils && \ apt-get clean && rm -rf /var/lib/apt/lists/* ``` From 517ec715c94adf1db943927a3a821ef5b1467325 Mon Sep 17 00:00:00 2001 From: Jeshua Ben Joseph Date: Wed, 20 May 2026 22:20:47 -0700 Subject: [PATCH 10/11] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index c606759..9429c69 100644 --- a/README.md +++ b/README.md @@ -652,7 +652,7 @@ Ubuntu 26.04 LTS introduced two significant changes compared to earlier Ubuntu r |---------|---------| | **Compatibility** | `uutils coreutils` aims for GNU Coreutils compatibility but may have subtle behavioral differences that can break scripts relying on specific GNU flags or output formats. Test your Dockerfiles and scripts carefully when upgrading to the 26.04 base image. | | **Security** | Rust's memory-safety guarantees eliminate whole classes of memory-related vulnerabilities (buffer overflows, use-after-free, etc.). This is generally considered an improvement for security. However, the Rust implementations are newer and have had less real-world exposure than their GNU counterparts. | -| **Licensing** | Both `uutils coreutils` is licensed under the **MIT license**, whereas GNU Coreutils is **GPL-3.0**. Users or organizations with specific license requirements should review these changes. | +| **Licensing** | Both `uutils coreutils` and GNU Coreutils are licensed under different terms: `uutils coreutils` uses the **MIT license**, whereas GNU Coreutils is **GPL-3.0**. Users or organizations with specific license requirements should review these changes. | | **Maturity** | `uutils coreutils` is a newer project. Some edge cases, rarely-used options, or locale-sensitive behavior may differ from the GNU originals. | #### Alternatives From 7690903458129aa9022cbaef2bdea3973dfbcf42 Mon Sep 17 00:00:00 2001 From: PikachuEXE Date: Thu, 21 May 2026 13:26:59 +0800 Subject: [PATCH 11/11] Apply suggestion from @PikachuEXE --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 9429c69..9818ab3 100644 --- a/README.md +++ b/README.md @@ -652,7 +652,7 @@ Ubuntu 26.04 LTS introduced two significant changes compared to earlier Ubuntu r |---------|---------| | **Compatibility** | `uutils coreutils` aims for GNU Coreutils compatibility but may have subtle behavioral differences that can break scripts relying on specific GNU flags or output formats. Test your Dockerfiles and scripts carefully when upgrading to the 26.04 base image. | | **Security** | Rust's memory-safety guarantees eliminate whole classes of memory-related vulnerabilities (buffer overflows, use-after-free, etc.). This is generally considered an improvement for security. However, the Rust implementations are newer and have had less real-world exposure than their GNU counterparts. | -| **Licensing** | Both `uutils coreutils` and GNU Coreutils are licensed under different terms: `uutils coreutils` uses the **MIT license**, whereas GNU Coreutils is **GPL-3.0**. Users or organizations with specific license requirements should review these changes. | +| **Licensing** | `uutils coreutils` and GNU Coreutils are licensed under different terms: `uutils coreutils` uses the **MIT license**, whereas GNU Coreutils is **GPL-3.0**. Users or organizations with specific license requirements should review these changes. | | **Maturity** | `uutils coreutils` is a newer project. Some edge cases, rarely-used options, or locale-sensitive behavior may differ from the GNU originals. | #### Alternatives