[avallete]

TL;DR

Postgres slim images get a third release line, for Docker Hub tags 17.x.x.NNN-orioledb. It sits beside stock 15 and stock 17, so the new stack can run OrioleDB locally. The line follows immutable -rN revisions from #326. Each Oriole tag is built from its own upstream Dockerfile-orioledb-17, so 17.9.x and the 17.11.x tags in upstream ansible/vars.yml both match their docker.io images.

Before

flowchart LR
  A["Hub tag 17.x.x.NNN-orioledb"] --> B["ignored by poller"]
  C["Hub tag 15 / 17"] --> D["postgres-<upstream>-rN"]

Loading

After

flowchart LR
  A["Hub tag 17.x.x.NNN-orioledb"] --> B{"&lt;upstream&gt;-rN<br/>published?"}
  B -- yes --> S["skip"]
  B -- no --> C["dispatch; each line gets a turn"]
  C --> D["build psql_orioledb-17_cli_portable<br/>config from that tag's Dockerfile"]
  D --> E["parity vs docker.io tag"]
  E --> F["postgres-&lt;upstream&gt;-r0"]

Loading

Why

OrioleDB graduates to beta on Oct 1, and the CLI is dropping its experimental flag. Slim images only shipped stock 15 and 17. Upstream now pins postgresorioledb-17: "17.11.0.002-orioledb" beside 17.11.0.002 and 15.19.0.002 (vars.yml). The Oriole config also changed across those tags:

• 17.9: orioledb is appended to the preload list.
• beta18: adds output_plugin_libraries.
• 17.11: orioledb moves to the front of the preload list.

What changed

• Release line. New ^17\.[0-9]+\.[0-9]+\.[0-9]{3}-orioledb$ line with floor 17.9.0.028-orioledb. PG15 Oriole tags, arch-specific tags and other suffixes stay ignored.
• Bundle. psql_orioledb-17_cli_portable is built from Dockerfile-orioledb-17:
  • orioledb is preloaded and default_table_access_method = orioledb.
  • 00-pre-init.sql creates the extension.
  • TimescaleDB and plv8 are omitted. PostGIS and pgRouting stay installed, as upstream ships them, but are removed from the supautils allowlist.
• Per-tag config detection. The preload position and output_plugin_libraries are read from the selected tag's Dockerfile, not from a version comparison.
• Receipts and identity. Smoke treats a Nix receipt version such as 17_20 or 17_22 as Oriole. UID/GID come from that Hub tag's digest.
• Revisions. The poller counts an Oriole tag as published only once postgres-<upstream>-rN exists. The existing legacy postgres-17.9.0.028-orioledb is frozen and will be republished as -r0.
• Fair dispatch. The poller skips published, active, cooling and settling tags first, then interleaves the three lines. A published stock prefix can no longer use up the Oriole turn.
• Results and mirrors.
  • The manifest download, the README tables and the ECR/S3 audit keep one newest revision per line, keyed by upstream_version.
  • Table generation now fails loudly on a bad manifest.

After merge, the poller publishes the Oriole backlog as -r0: 17.9.0.028, 17.9.0.029, 17.11.0.001 and 17.11.0.002 (all -orioledb). To dispatch one by hand:

gh workflow run service-release.yml -f service=postgres -f version=17.11.0.002-orioledb

Validation

• repository-checks passes. The poller, release-results and ecr-mirror tests cover one row per line and ignoring legacy releases.
• service-release validation_only on this branch for every Oriole backlog tag: all green, including docker.io parity: 17.9.0.028, 17.9.0.029, 17.11.0.001, 17.11.0.002.

🤖 Generated with Claude Code