[xuwei-fit2cloud]

Summary

• Pin the PostgreSQL 17 Bookworm pgvector image by digest and apply Debian updates in the shared base. Keep the PostgreSQL 17 data directory unchanged. Backport the HarfBuzz fix and remove the unused system TIFF loader while preserving Pillow TIFF support.
• Build and tag the runtime and compiler bases together. Use the requested version tag, such as v1.10.4, for both images in every selected registry. Add latest when the official release option is enabled. Prebuild FreeTDS and install the native toolchain in the compiler base so application builds can reuse them. Keep the Oracle client and license validator in the runtime base. Derive the Aliyun default base image addresses from secrets.ALIYUN_REGISTRY_HOST while allowing explicit image overrides.
• Omit the unused ONNX export of the default Chinese embedding model. Keep the PyTorch weights and tokenizer for offline inference. Exclude the PyTorch wheel’s test executables from the runtime image and retain Python’s precompiled bytecode.
• Update the installer's online Compose fallback to v5.7.0. Offline Docker Engine and Compose packages are unchanged.
• Update the image build workflows to Docker login action v4 and write application build arguments to GITHUB_OUTPUT.
• Upgrade uv and uvx from 0.7.8 to 0.13.7 in the shared base-image stage and pin the multi-platform image digest.

Validation

• The AMD64 application image went from 1.82 GB to 1.44 GB of compressed image content, a reduction of 377 MB (21%). Excluding the PyTorch test executables saved another 40 MB, bringing the compressed image to 1.40 GB. The optimized manifest is sha256:b7c960e222f4b97b40b35fd6e1a2b6108b32cd09b6ad9dce6621459a4a20477f. Five embedding vectors produced without network access matched byte for byte before and after the change.
• Reopened an isolated volume created on PostgreSQL 17.6, verified existing vector data and its HNSW index, and tested the pgvector extension upgrade. SQLBot returned HTTP 200, both PostgreSQL drivers queried pgvector, MCP listed seven tools and served a 1280 × 960 chart PNG, and Pillow read and wrote TIFF.
• The optimized image retained the package and native library inventory checked against the remediation checklist. The 70 checked Debian entries met their fixed versions; the HarfBuzz backport and system TIFF removal were verified. PyTorch RPC and GLib findings remain open for review.
• Checked the AMD64/ARM64 Bake configuration and the ARM64 PostgreSQL build definition. Runtime validation was on AMD64.
• Both image build workflows passed actionlint. Locally executed the application preparation steps for 12 registry, platform and latest-tag combinations; the resulting build arguments and tags matched the previous revision. Verified the base-image tag generation and Bake targets for 12 registry, platform and latest-tag combinations.
• Rebuilt both AMD64 base images and verified uv and uvx 0.13.7 in each. Checked the previous lockfile offline in the rebuilt compiler base. A separate AMD64 backend build with uv 0.13.7 passed dependency installation, uv pip check, and database driver imports. Both uv versions resolved the same 258 package/version records with identical inputs. Verified the ARM64 uv binary and build definition.

Publish both base images with matching tags before building the application. For a versioned build, pass the matching images through runtimeBaseImage and builderBaseImage.