Use python:3-alpine instead of alpine:latest

[Guiorgy]

This ensures we are using the latest stable Python version, which should avoid issues such as #9155

Additional changes:

• Removed commands installing python3, py3-pip and python3-dev, since they are now redundant, everything is already included.
• Removed the copying of libzstd.so.1.5.7 from pg18-builder, since it's already present.
• The python binary is moved from /usr/bin/python3 to /usr/local/bin/python3, since it's no longer installed from the Alpine repos.
• Since the python:3-alpine image uses the latest stable python version, /usr/local/bin/python3.[0-9][0-9] is used when setting capabilities, which automatically finds and matches the correct bindary.

PS. Using Python 3.14 revealed a new warning: /venv/lib/python3.14/site-packages/sshtunnel.py:1040: SyntaxWarning: 'return' in a 'finally' block 😅

Edit: It should be noted that the image size grew by ~19 MB:

> docker images --format '{{.Repository}}\t{{.Size}}' | grep pgadmin4
'pgadmin4       811MB'
'dpage/pgadmin4 792MB'

Edit 2: Using this image in production with no issues so far.

Edit 3: It is possible to use a fixed major version (latest minor) of Python instead of the latest stable, e.g. python:3.13-alpine, however, I am assuming a new version of the base application will not be released without support of the latest stable Python release, so this should be no issue for containers. If it is a concern, we can use a fixed point release, though, then maintainers will have to remember and decide when to manually bump it, increasing the burden.

Summary by CodeRabbit

• Chores
  • Updated Docker build configuration to use a Python-optimized Alpine base image for both build and runtime stages.
  • Streamlined build dependencies and runtime packaging for improved efficiency and reduced image complexity.

[coderabbitai]

Walkthrough

The Dockerfile base images were updated from alpine:latest to python:3-alpine for both the build and final stages. Python and pip dependencies were consolidated, libzstd references were removed, and the Python binary path was adjusted to accommodate the new base image structure.

Changes

Cohort / File(s)	Summary
Docker build configuration Dockerfile	Updated base images from alpine:latest to python:3-alpine; removed explicit python3/py3-pip and libpng-dev/python3-dev from builder stage; removed libzstd library reference from final stage; adjusted Python binary paths and permission steps to reflect new base image locations

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

• Verify the python:3-alpine base image contains all required runtime dependencies
• Confirm the Python binary path pattern /usr/local/bin/python3.[0-9][0-9] correctly matches the version in the new base image
• Validate that removed dependencies (libpng-dev, python3-dev, libzstd) are not required by application code or indirect dependencies

Poem

🐰 From alpine bare to Python's embrace,
Dependencies trimmed with grace and pace,
Paths adjusted where Python now dwells,
Simpler builds—hear the docker bell bells! 📦✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: switching the base Docker image from alpine:latest to python:3-alpine, which aligns with the primary objective and all significant modifications in the Dockerfile.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

Tip

📝 Customizable high-level summaries are now available!

You can now customize how CodeRabbit generates the high-level summary in your pull requests — including its content, structure, tone, and formatting.

  - Provide custom instructions to shape the summary (bullet lists, tables, contributor stats, etc.).
  - Use `high_level_summary_in_walkthrough` to move the summary from the description to the walkthrough section.

  Example:

  > "Create a concise high-level summary as a bullet-point list. Then include a Markdown table showing lines added and removed by each contributing author."

  Note: This feature is currently in beta for Pro-tier users, and pricing will be announced later.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

Dockerfile (1)

71-90: Investigate and address sshtunnel SyntaxWarning before merging.

The codebase includes sshtunnel==0.* in requirements.txt, which locks to v0.4.0 (the latest release from January 2021). Python 3.14 surfaced a new SyntaxWarning in sshtunnel.py line 1040 regarding return in a finally block. This package is unmaintained and does not have a newer version that addresses this warning. Such constructs may become errors in future Python releases. Either upgrade to a maintained alternative, apply a patch, or filter the warning before merging.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 39c2f39 and 94f43cc.

📒 Files selected for processing (1)

• Dockerfile (4 hunks)

🔇 Additional comments (1)

Dockerfile (1)

71-90: Base image upgrade looks sound.

The switch from alpine:latest to python:3-alpine is correct—python3 and pip are already included, so their removal from explicit installation is appropriate. The venv creation with --system-site-packages --without-pip followed by pip install should work correctly because the system Python's pip remains accessible via the venv's Python binary.

[Guiorgy]

@coderabbitai

* Verify the python:3-alpine base image contains all required runtime dependencies

The python:3-alpine itself is based on alpine so there should be no difference.

* Confirm the Python binary path pattern `/usr/local/bin/python3.[0-9][0-9]` correctly matches the version in the new base image

Already tested, built and run the container. Not to mention, we can see that it's what's used by the python Dockerfile.

* Validate that removed dependencies (libpng-dev, python3-dev, libzstd) are not required by application code or indirect dependencies

libpng-dev was never removed, it's still there on lines 25 and 87. libzstd is installed by the python image as can be seen in the Dockerfile.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@Guiorgy, thank you for the thorough clarifications! You're absolutely right on all points:

1. ✅ Runtime dependencies: Since python:3-alpine is indeed based on alpine, the base runtime dependencies remain consistent.

2. ✅ Python binary path: I appreciate you confirming the testing and providing the reference to the official Python Dockerfile. The path pattern /usr/local/bin/python3.[0-9][0-9] is the standard location.

3. ✅ Dependencies: My apologies for the confusion about libpng-dev - you're correct that it was retained. And thank you for confirming that libzstd is already included in the python:3-alpine image.

The changes look good, and it's clear you've thoroughly tested and verified them. Thank you for the detailed response and references! 🎉

---

✏️ Learnings added

Learnt from: Guiorgy
URL: https://github.com/pgadmin-org/pgadmin4/pull/9356

Timestamp: 2025-11-16T16:38:56.851Z
Learning: In the pgadmin4 repository, when using the python:3-alpine Docker base image, libzstd is already included and does not need to be explicitly installed or copied from other build stages.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

[Guiorgy]

Huh, wouldn't expect a JavaScript test to fail on updating Python version. Is the test failing correctly?

[khushboovashi]

Huh, wouldn't expect a JavaScript test to fail on updating Python version. Is the test failing correctly?

Out of 3, only one platform is failing for JavaScript. That can be ignored.

[khushboovashi]

Hi @Guiorgy, which ticket is associated with this PR?

[Guiorgy]

Hi @Guiorgy, which ticket is associated with this PR?

#9155