chore: update base image to HAProxy 3.2 LTS on Alpine 3.24

[oleksandr-nc]

HAProxy 3.1 is unmaintained since Q1 2026 and Docker Hub no longer rebuilds 3.1 images, so this moves the base image to the current LTS branch (3.2.22, supported until Q2 2030) on Alpine 3.24.

Alpine 3.24 ships Python 3.14, and the pinned pydantic 2.10.6 has no wheels for it, so pydantic moves to 2.13.4 (cp314 musl wheels for both amd64 and arm64). No code or config changes needed: haproxy -c is clean on 3.2.

Verified live besides CI: SPOA auth and routing, FRP tunnels, timeout semantics (client, server, tunnel including the 0 to 24d unlimited mapping), idle WebSocket survival, and a full app-skeleton-python deploy lifecycle through the new image.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b9cb23ca-84f2-4ca1-b7f1-1f21e553b286

📥 Commits

Reviewing files that changed from the base of the PR and between d9d3643 and 5f3ef21.

📒 Files selected for processing (2)

• Dockerfile
• development/debugging/Dockerfile

---

📝 Walkthrough

Walkthrough

The Dockerfiles update HAProxy from 3.1.2 on Alpine 3.21 to 3.2.22 on Alpine 3.24. The main Dockerfile also updates the pinned pydantic version from 2.10.6 to 2.13.4.

Merge Risk: ⚪ Minimal · up to 5f3ef

This updates the HAProxy and Alpine base images and the compatible pydantic runtime dependency; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: updating the HAProxy base image to the 3.2 LTS release on Alpine 3.24.
Description check	✅ Passed	The description directly explains the HAProxy, Alpine, and pydantic updates and the verification performed.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[oleksandr-nc]

The library fix is merged: cloud-py-api/haproxy-python-spoa#1. CI builds install the library from git master, so re-runs from now on include it. Re-running the deploy workflows several times to confirm the flake is gone.

[oleksandr-nc]

CI verified after the library fix (cloud-py-api/haproxy-python-spoa#1, merged): the Docker deploy workflow passed 3 consecutive attempts (the "NC In Host (Manual HaRP-Host network)" job that caught the SPOP regression included), and all four K8s deploy workflows passed 2 consecutive attempts. All 17 checks are green. From my side this is ready to merge.

[oleksandr-nc]

Upstream report for the mux side of this: haproxy/haproxy#3478 (verified affected: 3.2.0, 3.2.22, 3.3, 3.4 and 3.5-dev4; 3.1.2 clean). The library-side workaround from cloud-py-api/haproxy-python-spoa#1 keeps HaRP unaffected regardless of when upstream fixes it.