azavea / docker-django Goto Github PK

Django versions 3.0.7 and 2.2.13 will be released on Wednesday, June 3, 2020 around 1000 UTC. They will fix two security defects with severity of "medium" and "low".

See:

• https://travis-ci.org/github/azavea/docker-django/builds/672582070

Django 3.0 was recently released (release notes). We should consider adding an image variant to support it, which will be the mainstream release until August 2020 and will receive extended support until April 2021 (Django release timeline).

Django 3.0 supports the following Python versions (see table in release notes):

• 3.6
• 3.7
• 3.8

Add Django 2.0 to the image creation process. Also, double-check what versions are deprecated and consider dropping them from our build matrix (likely coupled with an announcement so that we can prioritize app upgrades internally).

See:

• https://docs.djangoproject.com/en/2.1/releases/1.11.17/
• https://travis-ci.org/azavea/docker-django/builds/461797917 (passing master build)

Replace the existing Travis CI configuration with one based on GitHub Actions. Ensure that:

• Matrix builds are preserved
• Merges to master are automatically published to Quay

See: https://github.com/azavea/docker-tippecanoe

See https://www.djangoproject.com/weblog/2018/jun/01/bugfix-release/

See: https://docs.djangoproject.com/en/1.11/releases/1.11.4/

Django versions 3.0.4, 2.2.11 and 1.11.29 will be released on Wednesday, March 4, 2020 around 1000 UTC.They will fix a security defect with severity “high”.

See: https://travis-ci.org/azavea/docker-django/builds/645553085 (all builds failed, but they look to be PostgreSQL client library specific)

See:

• https://docs.djangoproject.com/en/3.0/releases/2.2.12/
• https://travis-ci.org/github/azavea/docker-django/builds/658365772

See:

• https://docs.djangoproject.com/en/2.0/releases/2.0.10/
• https://docs.djangoproject.com/en/2.0/releases/1.11.18/
• https://travis-ci.org/azavea/docker-django/builds/466162336

Django versions 2.2.3, 2.1.10, 1.11.22 will be released on
Monday, July 1, 2019 around 1400 UTC. They will fix one security defect with
severity “low".

See: https://travis-ci.org/azavea/docker-django/builds/540919633

An example of a failed build log:

gpg: keybox '/tmp/tmp.68k2oubm9U/pubring.kbx' created
gpg: keyserver receive failed: Cannot assign requested address

Can be resolved by restarting the job, sometimes multiple times.

Psycopg2 is changing the way their binary package installations work in 2.8.x. Details are outlined here:

http://initd.org/psycopg/articles/2018/02/08/psycopg-274-released/

The change forces two solution paths:

1. Change the package name to psycopg2-binary to continue receiving binary packages
2. Install the package with --no-binary to force an installation from source

Approach two seems like the most desirable for us given that we already install the build tools needed to build the source. Also, using the source gives us a bit more control over the versions of OpenSSL and libpq used.

See: https://travis-ci.org/github/azavea/docker-django/jobs/694399185

Django 2.1 was released today (8/1). Consider adding it to the published images set.

Considerations:

• Will we use it internally?
• Is it an LTS?

See:

• https://docs.djangoproject.com/en/2.1/releases/2.0.9/
• https://docs.djangoproject.com/en/2.1/releases/1.11.16/
• https://travis-ci.org/azavea/docker-django/builds/411387741 (failing master build)

See:

• https://www.djangoproject.com/weblog/2020/aug/03/django-bugfix-releases-309-2215/
• https://github.com/azavea/docker-django/actions/runs/186054019

See:

• https://docs.djangoproject.com/en/2.0/releases/2.0.4/
• https://docs.djangoproject.com/en/1.11/releases/1.11.12/

Django versions 2.2.8 and 2.1.15, together with Django 3.0 final will be released on Monday, December 2, 2019 around 1400 UTC. They will fix a security defect with severity “medium”.

See: https://travis-ci.org/azavea/docker-django/builds/608335454

Django versions 3.0.1, 2.2.9 and 1.11.27 will be released on
Wednesday, December 18, 2019 around 1200 UTC.
They will fix a security defect with severity “high”.

See: https://travis-ci.org/azavea/docker-django/builds/620346346

We should use GitHub Actions to automatically label and close out issues that are not actionable or otherwise haven't been prioritized. The stale action is ideal for this.

The length of time before an action is considered stale is configurable. I think that a good starting point for this project would be 60 days until stale and a further 7 until close, the default settings. We typically create issues in response to Django upgrades being available and address those quickly. Other enhancement requests that are not prioritized within that time period are not likely to be prioritized later.

See:

• https://docs.djangoproject.com/en/2.0/releases/2.0.8/
• https://docs.djangoproject.com/en/2.0/releases/1.11.15/
• https://travis-ci.org/azavea/docker-django/builds/400951337

See:

• https://docs.djangoproject.com/en/2.0/releases/2.0.7/
• https://docs.djangoproject.com/en/2.0/releases/1.11.14/
• https://travis-ci.org/azavea/docker-django/builds/388833116

Add Django 1.8 to the build matrix and ensure that the resulting container images function.

It looks like the version of GDAL in the Alpine Linux testing repository is unsupported by GeoDjango. The version of GDAL from Alpine Linux is 2.3.2-r0, and GeoDjango only supports up to 2.2. The version of GDAL in Debian Stretch is 2.1.2+dfsg-5.

See packages:

• https://packages.debian.org/stretch/gdal-bin
• https://pkgs.alpinelinux.org/packages?name=gdal&branch=edge

See GeoDjango geolibs comparability matrix: https://docs.djangoproject.com/en/2.1/ref/contrib/gis/install/geolibs/

Django versions 2.2.4, 2.1.11, 1.11.23 will be released on Thursday, August 1, 2019 around 1000 UTC. They will fix four security defects with severity “medium” to “low".

See: https://travis-ci.org/azavea/docker-django/builds/553016259

Django versions 2.2.2, 2.1.9, 1.11.21 will be released on Monday, June 3, 2019 around 1400 UTC. They will fix two security defect with severity “medium".

See: https://travis-ci.org/azavea/docker-django/builds/527466353

See:

• https://www.djangoproject.com/weblog/2019/oct/01/bugfix-releases/
• https://travis-ci.org/azavea/docker-django/builds/585695982

Django versions 3.0.3, 2.2.10 and 1.11.28 will be released on Monday, February 3, 2020 around 1000 UTC.
They will fix a security defect with severity “high”.

See: https://travis-ci.org/azavea/docker-django/builds/638564562

See:

• https://www.djangoproject.com/weblog/2020/jul/01/django-bugfix-releases-308-2214/
• https://travis-ci.org/github/azavea/docker-django/builds/701408951

See:

• https://docs.djangoproject.com/en/1.11/releases/1.11.5/
• https://docs.djangoproject.com/en/1.10/releases/1.11.8/

Still unreleased, but good to keep on the radar. Scheduled release is 2/1.

Django 2.2.8 has added support for Python 3.8, as mentioned in the release notes:

Django 2.2.8 fixes a security issue, several bugs in 2.2.7, and adds compatibility with Python 3.8.

We should add a Python 3.8 variant image to our Django 2.2 build matrix.

We should use GitHub Actions to apply the operations and backlog labels to all incoming issues to automatically put them into our triage queue. We can use the labeler Action to apply these labels for all file paths. Any issues submitted here are going to go through operations first regardless of their nature. We might as well automate this initial triage.

This prevents errors when PostgreSQL 12.x server is being used, but we want to make use of PostgreSQL client tooling (e.g., psql). We may also want to confirm that 12.x client libraries play well with 11.x and under server.

See: https://stackoverflow.com/a/58461430

See:

• https://www.djangoproject.com/weblog/2019/sep/02/django-bugfix-releases-225-2112-11124/
• https://travis-ci.org/azavea/docker-django/builds/568046193

(All variants appear to be failing due to PostgreSQL version changes.)

Django 2.2, the next LTS release, was released today (4/1). Consider adding it to the published images set.

See:

• https://www.djangoproject.com/weblog/2019/apr/01/django-22-released/
• https://travis-ci.org/azavea/docker-django/builds/492780357

Django 2.2.17 adds compatibility with Python 3.9.

We should also consider adding Python 3.9 to the build matrix.

See: https://docs.djangoproject.com/en/3.1/releases/2.2.17/

https://docs.djangoproject.com/en/1.11/releases/1.11.6/

Still unreleased, but good to keep on the radar. Scheduled release is 3/6.

See: https://docs.djangoproject.com/en/1.11/releases/1.11.7/

See:

• https://www.djangoproject.com/weblog/2019/may/01/django-bugfix-release-221/
• https://docs.djangoproject.com/en/2.2/releases/2.2.1/
• https://travis-ci.org/azavea/docker-django/builds/514789639

It looks like there are a few ways to go about this:

• Add a separate Dockerfile to this repo that extends python:3.6-slim instead of python:2.7-slim
• Create a separate repo that extends from python:3.6-slim.

I don't see how to sensibly swap out only the FROM instruction in the base Dockerfile provided in this repo without an almost duplicate Dockerfile. Maybe there's something clever though that I don't see given my limited Docker experience.

Thoughts @hectcastro ?

See:

• https://www.djangoproject.com/weblog/2019/nov/04/django-bugfix-releases-227-2114-11126/
• https://travis-ci.org/azavea/docker-django/builds/607167943

Should we remove this version from the build matrix? Or continue maintaining it so the underlying OS can receive security updates? When are we going to start supporting Django 3.x?

This issue is to answer these questions and outline next steps (or confirm the lack there of).

See: https://www.djangoproject.com/weblog/2020/apr/01/bugfix-releases/

See:

• https://docs.djangoproject.com/en/2.0/releases/2.0.4/
• https://docs.djangoproject.com/en/1.11/releases/1.11.12/

Django versions 3.1.1, 3.0.10, and 2.2.16 will be released on Tuesday, September 1, 2020 around 1000 UTC. They will fix two security defect with severity “low”.

See:

• https://docs.djangoproject.com/en/dev/internals/security/#how-django-discloses-security-issues
• https://github.com/azavea/docker-django/actions/runs/223853299 (slim builds are failing)

Django 1.11 is the next LTS: https://www.djangoproject.com/weblog/2017/apr/04/django-111-released/

These releases do not yet exist, but have been announced for 2/11.

In addition, we should consider removing Django 1.9 and 1.10 from the build matrix, as both releases are EOL.

See: https://travis-ci.org/azavea/docker-django/builds/478516216