docker: Update Fedora base image to 40
What the developer wrote
Authored by ShahanaFarooqui
docker: Update Fedora base image to 40
- Upgraded Fedora base image from 35 to 40. The existing Cargo failures were caused by the outdated Rust toolchain in Fedora 35. Cargo lockfile format v4 was introduced in Cargo 1.84 (December 2024), while Fedora 35 provides a Rust/Cargo version from roughly 2021–2022. As a result, the system Cargo could not parse modern Cargo.lock files, making it incompatible with current Rust projects.
- Added missing build dependencies to the Dockerfile, most notably the protobuf compiler (protoc).
Changelog-None: Upgraded Fedora version to 40 for reproducible build.
What changed, and why it matters
This commit updates a Fedora-based Docker builder image used for compiling Core Lightning. It moves from an old Fedora release (35) to a current one (40), adds missing build tools such as the protobuf compiler, and switches to a modern Rust toolchain via rustup so the build can understand newer Cargo lockfiles. There is no security flaw being fixed here; it is routine build-environment maintenance.
No security action required. Review the Dockerfile for supply-chain hygiene (verify rustup/uv/lowdown/bitcoin download sources and checksums), but treat this as ordinary build maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies contrib/docker/Dockerfile.builder.fedora: base image changed from fedora:35 to fedora:40, several missing build dependencies added (which, sed, gettext-devel, gmp-devel, python3-devel, python3-pip, python3-poetry, postgresql-devel, protobuf-compiler, protobuf-devel), Rust installed via rustup instead of the distro cargo package, and lowdown/bitcoin/uv installation steps refactored. The stated motivation is toolchain compatibility (Cargo lockfile v4 requires Rust/Cargo ≥1.84) and reproducible builds. No vulnerability is patched or introduced in the diff itself.
Changed components
contrib/docker/Dockerfile.builder.fedoraInspect captured patch +24 / −7
diff --git a/contrib/docker/Dockerfile.builder.fedora b/contrib/docker/Dockerfile.builder.fedora
index 7d4b903f..ec0c2d37 100644
--- a/contrib/docker/Dockerfile.builder.fedora
+++ b/contrib/docker/Dockerfile.builder.fedora
@@ -1,4 +1,4 @@
-FROM fedora:35
+FROM fedora:40
ENV UV_PYTHON=3.12
ENV BITCOIN_VERSION=27.1
@@ -21,8 +21,25 @@ RUN dnf update -y && \
xz \
zlib-devel \
cargo \
- libsodium-devel && \
- wget https://github.com/kristapsdz/lowdown/archive/refs/tags/VERSION_1_0_2.tar.gz && \
+ libsodium-devel \
+ which \
+ sed \
+ gettext-devel \
+ gmp-devel \
+ python3-devel \
+ python3-pip \
+ python3-poetry \
+ postgresql-devel \
+ protobuf-compiler \
+ protobuf-devel && \
+ dnf clean all
+
+# Install Rust via rustup (for lockfile v4 support)
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+# Install lowdown
+RUN wget https://github.com/kristapsdz/lowdown/archive/refs/tags/VERSION_1_0_2.tar.gz && \
tar -xzf VERSION_1_0_2.tar.gz && \
cd lowdown-VERSION_1_0_2 && \
./configure && \
@@ -30,9 +47,9 @@ RUN dnf update -y && \
make install && \
ldconfig && \
cd /tmp && \
- rm -rf VERSION_1_0_2.tar.gz lowdown-VERSION_1_0_2 && \
- dnf clean all
+ rm -rf VERSION_1_0_2.tar.gz lowdown-VERSION_1_0_2
+# Install Bitcoin Core
RUN wget https://storage.googleapis.com/c-lightning-tests/bitcoind/bitcoin-${BITCOIN_VERSION}-x86_64-linux-gnu.tar.gz \
-O bitcoin.tar.gz && \
tar -xvzf bitcoin.tar.gz && \
@@ -42,6 +59,6 @@ RUN wget https://storage.googleapis.com/c-lightning-tests/bitcoind/bitcoin-${BIT
mv bitcoin-$BITCOIN_VERSION/share/man/man1/* /usr/share/man/man1 && \
rm -rf bitcoin.tar.gz bitcoin-$BITCOIN_VERSION
-# Ensure `uv` can be found
-ENV PATH=${PATH}:/root/.local/bin
+# Install uv
+ENV PATH="${PATH}:/root/.local/bin"
RUN wget -qO- https://astral.sh/uv/install.sh | sh
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.