From 94a1c8e979a39b54b839595ed45a313b25a6fe10 Mon Sep 17 00:00:00 2001
From: kami <kami@kvmx.ru>
Date: Fri, 3 Jul 2026 22:00:19 +0400
Subject: [PATCH] =?UTF-8?q?deploy:=20fix=20image=20build=20=E2=80=94=20tri?=
 =?UTF-8?q?xie/go1.24=20base,=20rename=20off=20the=20maven=20collision?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three fixes found bringing the stack up on the host daemon:

- base was golang:1.23-bookworm: bookworm's glibc 2.36 / GLIBCXX 3.4.30 is too
  old to link the prebuilt deps/lib/*.so (built on Arch against glibc 2.38 /
  GLIBCXX 3.4.32). Moved build+runtime to trixie (glibc 2.40). golang trixie
  images start at 1.24, which builds the go 1.23 module fine.
- builder now installs libvulkan-dev — libggml-vulkan.so needs libvulkan.so.1
  at link time.
- image renamed maven:latest -> mavenai:latest with pull_policy:never. "maven"
  is Apache Maven on Docker Hub; compose was silently pulling it, so every
  container ran mvn-entrypoint.sh and exited 127.

Verified on the host: all six build, five-service stack stays up, mavend opens
the encrypted db, mavweb GET :9201 -> 200.
---
 Dockerfile         | 13 +++++++++++--
 docker-compose.yml |  5 ++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 43f8bb8..9752ebc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,9 +12,18 @@
 # ponytail: prebuilt-lib copy, not a from-source build. Add a whisper.cpp build
 # stage if you ever need reproducibility / a different arch than the host libs.
 
-FROM golang:1.23-bookworm AS build
+# trixie, not bookworm: the prebuilt deps/lib/*.so are linked against
+# glibc 2.38 + GLIBCXX 3.4.32 (built on the Arch host). bookworm's glibc 2.36
+# is too old and the link fails on missing symbols. trixie ships glibc 2.40.
+# 1.24 (not 1.23) because golang trixie images start at 1.24; go 1.24 builds the
+# `go 1.23` module fine (the directive is a minimum).
+FROM golang:1.24-trixie AS build
 WORKDIR /src
 
+# libvulkan-dev: libggml-vulkan.so needs libvulkan.so.1 at link time.
+RUN apt-get update && apt-get install -y --no-install-recommends libvulkan-dev \
+    && rm -rf /var/lib/apt/lists/*
+
 # native build inputs (prebuilt libs + headers), then module cache, then source
 COPY deps/lib/ /src/deps/lib/
 COPY deps/piper/ /src/deps/piper/
@@ -37,7 +46,7 @@ RUN go build -o /out/mavend    ./cmd/mavend    && \
     go build -o /out/mavpoll   ./cmd/mavpoll   && \
     go build -o /out/mavcaldav ./cmd/mavcaldav
 
-FROM debian:bookworm-slim AS runtime
+FROM debian:trixie-slim AS runtime
 RUN apt-get update && apt-get install -y --no-install-recommends \
       ca-certificates libvulkan1 mesa-vulkan-drivers libgomp1 && \
     rm -rf /var/lib/apt/lists/*
diff --git a/docker-compose.yml b/docker-compose.yml
index 61374ac..dd7892e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,7 +6,10 @@ name: maven
 # the bare-metal setup, only paths move to /run/maven.
 
 x-image: &image
-  image: maven:latest
+  # NOT "maven" — that's Apache Maven on Docker Hub and compose will happily
+  # pull it, giving every container `mvn-entrypoint.sh` and exit 127.
+  image: mavenai:latest
+  pull_policy: never   # only ever the locally-built image
   restart: unless-stopped
 
 services: