Update to Debian Bookworm

Mount /dev/shm in the container by setting ipc to "private". This is
the same as "none" (the previous value) with the only difference being
that shm is mounted. This is needed for integration tests to pass.

The integration tests always relied on shared memory due to their use of
multiprocessing. They managed to work because glibc used to fall back to
/tmp if /dev/shm wasn't available. However, newer versions of glibc,
which Debian Bookworm now uses, removed that fallback behaviour.

1 files changed, 4 insertions, 4 deletions

diff --git a/Dockerfile b/Dockerfile
index 3fed387..14e23f0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.4
-FROM buildpack-deps:buster as builder-nsjail
+FROM buildpack-deps:bookworm as builder-nsjail
 
 WORKDIR /nsjail
 
@@ -17,7 +17,7 @@ RUN git clone -b master --single-branch https://github.com/google/nsjail.git . \
 RUN make
 
 # ------------------------------------------------------------------------------
-FROM buildpack-deps:buster as builder-py-base
+FROM buildpack-deps:bookworm as builder-py-base
 
 ENV PYENV_ROOT=/pyenv \
     PYTHON_CONFIGURE_OPTS='--disable-test-modules --enable-optimizations \
@@ -42,7 +42,7 @@ RUN git clone -b v2.3.26 --depth 1 https://github.com/pyenv/pyenv.git $PYENV_ROO
     && /build_python.sh 3.12.0rc2
 
 # ------------------------------------------------------------------------------
-FROM python:3.11-slim-buster as base
+FROM python:3.11-slim-bookworm as base
 
 ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
     PIP_NO_CACHE_DIR=false
@@ -52,7 +52,7 @@ RUN apt-get -y update \
         gcc \
         git \
         libnl-route-3-200 \
-        libprotobuf17 \
+        libprotobuf32 \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --link --from=builder-nsjail /nsjail/nsjail /usr/sbin/