Add alpine variants (templated)

[zakame]

Resolves #23. Adds Alpine Linux variants of the official perl images, templated through generate.pl rather than hand-edited per Perl version.

What changed

• Templated, not hand-edited. New Dockerfile.alpine.template (and a sibling Dockerfile.debian.template extracted from the old __DATA__ block). generate.pl dispatches by family.
• Schema: config.yml debian_release becomes os_release: [{family, tag}]. New build_constraints key expresses "no slim on alpine".
• Two alpine tags per Perl version: alpine3.23 and alpine3.24 (mirroring python:3-alpine / ruby:3-alpine cadence: current stable plus previous stable).
• No setlocale() workaround. Per current state of musl 1.2 + Perl 5.28+, the workaround is unnecessary.
• Patches per alpine dir, committed alongside the generated Dockerfile (same convention as the existing non-alpine dirs):
  • DevelPatchPerl.patch: the same Devel::PatchPerl output already used for Debian variants; only written when the diff is non-empty for that Perl version.
  • musl-stack-size.patch (static; bumps threaded stack floor to 256k, works around upstream perl 5.32.0 t/re/path_thr.t fails on Alpine Linux (musl libc) on s390x due to small stack_size perl5#18160 which remains open).
  • skip-test-due-to-busybox-ps.patch (generated per Perl version since the relevant line in t/op/magic.t drifts between minors; guard added so an empty patch fails loudly rather than silently).
  • A new t/check-patch-consistency.t statically verifies every alpine Dockerfile's required patches are present on disk and git-tracked, so a fresh clone can never be missing a patch its Dockerfile depends on.
• Build toolchain retained at runtime (parallel to debian-main's buildpack-deps base; diverges from python:3-alpine / ruby:3-alpine which scanelf-prune the compiler). Requires openssl and pkgconf in addition to openssl-dev, confirmed via live build test.
• tzdata included for DST timezone test coverage (ext/POSIX/t/time.t DST transition tests require /usr/share/zoneinfo/).
• HTTPS regression closed: Net::SSLeay 1.96, IO::Socket::SSL 2.099, cpanm 1.7049, and cpm v1.1.4 install at build time, matching debian-main parity. Both use --notest since their test suites make live TLS connections that are unreliable in isolated build environments; SSL correctness is verified by the CI "Run HTTPS access test" step.
• CI: uses existing .github/workflows/build-image.yml auto-discovery (dirname */Dockerfile). Added fail-fast: false so one variant failure no longer cancels all other jobs. No-lwp test uses sh instead of bash (Alpine only ships busybox sh). generate-dockerfiles-patches.yml now runs the t/ regression suite via prove -v t/*.t after regenerating, and its trigger paths cover every generation input (generate.pl, library.pl, both Dockerfile templates, musl-stack-size.patch, and t/**), so a change to any of them exercises the generate-and-diff check.
• library.pl: family-aware; emits both pinned (<version>-alpine3.24) and rolling (<version>-alpine, aliasing current stable) tags per the Ruby/Python convention.
• wget removed from the permanent apk add block; all downloads use curl, saving about 3.4 MiB per image.
• cpanm wget disabled: cpanm 1.7049 has try_wget=>1 by default; after patching try_lwp=>0, cpanm would fall through to wget before curl. Busybox wget lacks --retry-connrefused (a GNU wget flag cpanm passes unconditionally), causing build failures. Patched with perl -pi -E 's{try_wget=>1}{try_wget=>0}g' so cpanm uses curl directly.
• sha256sum asymmetry documented: Alpine uses sha256sum -c - (busybox sha256sum lacks --strict); Debian uses sha256sum --strict --check -. Each Dockerfile carries an inline comment explaining the intentional divergence.

Documentation

• generate.pl POD rewritten: run_tests default corrected to parallel, os_release schema documented (replaces legacy debian_release), build_constraints key explained with example, Alpine Variant Generation section added.
• library.pl POD added: =head1 FUNCTIONS documents entry() and release() with tag aliasing strategy and EOL compat shim.
• README updated: new "Alpine Variants" section with a Perl-version-independent published-tags table, and a Caveats list covering musl libc quirks, the stack-size patch, toolchain retention, tzdata, and busybox sh as the default shell.

Checklist

• Build without setlocale() workaround (musl 1.2 + Perl 5.28+ obsoletes it)
• Retain make plus full build toolchain so cpanm XS installs work
• Apply for all Perl versions via templating
• Live build and smoke test: perl 5.42.2, Net::SSLeay 1.96, IO::Socket::SSL 2.099, gcc toolchain retained, .build-deps purged
• Every alpine Dockerfile's patches present on disk and git-tracked (t/check-patch-consistency.t)
• POD documentation for generate.pl and library.pl
• README caveats for Alpine-specific behaviour

Testing

The regression suite lives in t/ as Perl/Test::More, run with prove:
prove -r t/. t/alpine-checks.t runs static checks unconditionally, with
runtime checks gated on RUN_RUNTIME=1. t/check-patch-consistency.t is
static, always. Both read the generated files, so run ./generate.pl first
on a fresh checkout.

Static (always):

• Directory count derived from config.yml (family: alpine entries times 2 threading variants)
• No slim+alpine combinations (enforces build_constraints)
• Per-tag balance: each alpine tag derived from config.yml must have the right count individually
• Each Dockerfile: COPY *.patch, cat *.patch | patch -p1, make test_harness_notty, FROM alpine:N.NN
• FROM alpine: tag matches directory name
• -Dusethreads in ./Configure matches ,threaded in directory name
• tzdata in permanent apk add block
• CMD perl version matches directory name (zero-pad stripped)
• cpanm patches present: HTTPS URL rewrite (s{http://), no-LWP (try_lwp=>0), and no-wget (try_wget=>0)
• Patch files non-empty and contain expected content (256*1024 hunk, busybox-ps skip message)
• Every *.patch a Dockerfile depends on is present on disk and git-tracked (check-patch-consistency.t)

Runtime (RUN_RUNTIME=1):

• Permanent toolchain packages retained (build-base, make, openssl-dev, linux-headers, libc-dev, zlib-dev, bzip2-dev, ca-certificates, curl)
• Transient .build-deps purged, checked per-package so partial retention is caught
• Compiler reachable (which gcc, which make, pkg-config --exists openssl)
• POSIX::setlocale does not die; actual locale value printed for CI logs
• use Net::SSLeay; use IO::Socket::SSL: verifies --notest installs are loadable
• Threaded variants: threads->create(sub {})->join smoke
• XS compile against linux-headers: Linux::Inotify2 (sys/inotify.h)

Closes #23.

[tianon]

Figured I'd leave a few notes on this, both to try to help out and as a subtle bump. 😏 ❤️

[JJ]

I would also like an Alpine variant, but probably the way to go would be to change everything from the ground up, including Releases.yaml and generate.pl

[J0WI]

try to apply for all Perl versions (maybe via Dockerfile.template)

Replacing generate.pl with an update.sh to integrate @docker-library-bot would be an other improvement.

[zakame]

Replacing generate.pl with an update.sh to integrate @docker-library-bot would be an other improvement.

Thanks, could you elaborate further?

I did a cursory check on update.sh from other official-image repos (namely percona, postgres, and php,) and for now I think these bring in some more complexity than I'd care to maintain; I'd be open for PRs for this however.

Another thing to consider is that generate.pl also calls Devel::PatchPerl if needed, so that should be taken into account for the conversion.

[J0WI]

The @docker-library-bot can trigger an update.sh to update Perl and generate Dockerfiles.
Just add it to https://github.com/docker-library/oi-janky-groovy/blob/master/update.sh/vars.groovy and give @docker-library-bot commit access.

[zakame]

Yeah, that's what I gathered on reading the update.sh from other images. Might be useful for Perl RC/BLEAD_POINT images, not so much on stable releases (and we already rebuild those anyway on the Hub side when buildpack-deps gets updated.)

Thanks for bringing this up anyway; I might get around to this soon as I'll be getting more involved with Perl RC builds and perhaps this might provide some additional way for managing/bring these up.

[tianon]

Saw some activity so I figured I'd re-review 😅 ❤️

[mohawk2]

This would still be great!

[rabbiveesh]

Is there something this is stalled on? I would love to help if possible

[zakame]

Size comparison:

perl:5-bookworm                        487c70ed270b       1.44GB          371MB
perl:5-slim-bookworm                   6c9850944b95        288MB         61.1MB
perl:5.042.002-main-alpine3.23-test    8b9704f40e99        468MB          115MB

Reminder that slim variants don't carry the build toolchain for installing XS CPAN modules by default.

[zakame]

I've revisited this now that all tests pass on the stock Perl testsuite - @tianon would appreciate a review! 🙇

@rabbiveesh @mohawk2 feel free to check as well!