Fix release Dockerfile's base builder image - use the same distro as in the runner image

Author: ImplOfAnImpl

build-tools/docker/Dockerfile.builder

@@ -8,11 +8,19 @@
 # TODO: dockerfile 1.7 syntax allows specifying --exclude for COPY, so the same can be done
 # without an additional stage. But at the moment of writing this it's still experimental.
 # Switch to using it when it becomes stable.
-FROM rust as source
+
+# Note: the base image here doesn't really matter, we just use the same one as in the "builder"
+# stage below.
+FROM rust:bookworm as source
 COPY . /src
 RUN rm -r /src/build-tools
 
-FROM rust AS builder
+# Note: the builder image should use the same or an older distro compared to the runner images,
+# so that its GLIBC version is also the same or older. Otherwise the built executables have
+# a chance to get a dependency on a newer version of some GLIBC symbol that is not present
+# in the runner's GLIBC, and the executables won't work.
+# TODO: consider producing musl-based executables instead.
+FROM rust:bookworm AS builder
 
 WORKDIR /usr/src/
 

build-tools/docker/Dockerfile.runner-base

@@ -1,3 +1,5 @@
+# Note: this must be consistent with the builder image's base image, see the corresponding comment
+# in Dockerfile.builder.
 FROM debian:bookworm-slim
 
 RUN apt-get update && apt-get install -y gosu && rm -rf /var/lib/apt/lists/*