Docker Hub images (6.1.0) still uses Bookworm instead of Trixie

[mkaplan-eyesclear]

The Dockerfile shows Debian Trixie and you closed multiple pull requests related Debian Trixie upgrade.
But when I checked your Docker Hub repo, still seeing Debian Bookworm image as base image. And this image has Critical Vulnerability

superset:6.1.0-py311

superset:6.1.0-py312

How can i find the Superset image which uses Debian Trixie?

[dosubot[bot]]

Hi @mkaplan-eyesclear! I'm Dosu and I'm helping the Apache Superset team.

The 6.1.0 Docker Hub images use Bookworm because the Dockerfile at the 6.1.0 tag has PY_VER=3.11.13-slim-bookworm and node:20-bookworm-slim as its base images [1]. The Trixie upgrade (via PR #34821, merged Aug 2025, and PR #36047, merged Nov 2025) landed on master after the 6.1.0 release branch was cut, so Trixie was never part of any 6.1.0 build.

The tag-release.yml workflow that publishes release images to Docker Hub uses supersetbot docker without overriding PY_VER [2], so the release images use whatever PY_VER default is in the Dockerfile at that tag — which for 6.1.0 is Bookworm.

There is currently an open PR #42509 that fixes a CI bug where the py311/py312 presets were silently building with the same base as lean rather than their own PY_VER pins. The PR description confirms the current master CI now passes --build-arg PY_VER=3.11.14-slim-trixie as a global override for the docker.yml workflow [3].

In short: Trixie is on master only and has not been released in any tagged version yet. To get a Trixie-based image today, you have two options:

1. Build from master — clone the repo at HEAD and run docker build --target lean .

2. Override PY_VER on the 6.1.0 tag — check out the 6.1.0 tag and build with:

   docker build --build-arg PY_VER=3.11.14-slim-trixie --target lean .

   Note: this is not officially tested by the project against 6.1.0, so there could be compatibility issues.

A future release (likely the next major/minor) should include Trixie-based images on Docker Hub by default.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[rusackas]

@hainenber @sha174n have any time to look into this one, perchance?

[hainenber]

I'll take a look at this weekend. I'm a bit occupied at $WORK 😵