feat(deployments): install deployed image base packages from a pinned Debian snapshot

[myftija]

Every project's image contained a near-duplicate base-packages layer: apt-get against the live Debian archive bakes build-time archive state, so identical Containerfiles produced different ~30MB blobs and worker nodes cached one per project. The generated Containerfile now installs base packages from a pinned snapshot.debian.org archive and scrubs apt's timestamped files, making the layer a pure function of the base image and the pinned date: every project converges on one identical blob that nodes cache once.

Verified by building on two independent cold-cache builders, which produced identical digests for every layer.

Notes

• Default packages now install before user instructions and pkgs, and user packages go in a separate sorted RUN, so customized projects still share the default layer. Instructions run with ca-certificates and git present and inherit the pinned sources.
• Base package versions freeze at the snapshot date and move forward with CLI releases; a test fails when the pin is over 90 days old, and the build asserts the base image codename matches the pinned suite with an error naming the escape hatch.
• TRIGGER_BUILD_SKIP_APT_SNAPSHOT=1 falls back to the live archive. Documented in the aptGet extension docs, which now also note that version pins resolve against the snapshot.
• Known limits: cold builds' archive dependency moves from the main Debian CDN to the best-effort snapshot.debian.org service (immutable and heavily CDN-cached, and mitigated by apt retries and the escape hatch, but a weaker SLA); builders that can only reach a private Debian mirror through image.instructions need the escape hatch plus their own sources; layers created by extensions' own apt-get calls remain per-project.

[changeset-bot]

🦋 Changeset detected

Latest commit: 94243ad

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 27 packages

Name	Type
trigger.dev	Patch
@internal/dashboard-agent	Patch
@trigger.dev/build	Patch
@trigger.dev/core	Patch
@trigger.dev/python	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/rsc	Patch
@trigger.dev/schema-to-json	Patch
@trigger.dev/sdk	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch
@trigger.dev/rbac	Patch
@trigger.dev/sso	Patch
@internal/cache	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@internal/metrics-pipeline	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/run-store	Patch
@internal/schedule-engine	Patch
@internal/testcontainers	Patch
@internal/tracing	Patch
@internal/tsql	Patch
@internal/sdk-compat-tests	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Walkthrough

Build image generation now installs base packages from pinned Debian snapshots by default. Default and user packages use separate installation layers for Bun and Node images. The build logic validates the Debian suite, configures APT retries, repairs broken dpkg state, and supports the TRIGGER_BUILD_SKIP_APT_SNAPSHOT=1 opt-out. Tests cover snapshot selection, package ordering, repair behavior, bypass behavior, and snapshot age. Documentation and a patch changeset describe the new behavior.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies the main change: installing deployed image base packages from a pinned Debian snapshot.
Description check	✅ Passed	The description clearly explains the change, testing, configuration behavior, documentation updates, and known limits, although it omits the template checklist and section headings.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch deterministic-apt-layer

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}