[gnmi] Migrate gnmi, telemetry, and watchdog containers to Debian Trixie by hdwhdw · Pull Request #26499 · sonic-net/sonic-buildimage

hdwhdw · 2026-04-01T02:35:51Z

Summary

Migrate the gnmi, telemetry, and watchdog containers from Debian Bookworm to Debian Trixie.

Update base image references from docker-config-engine-bookworm to docker-config-engine-trixie for all gnmi-related containers. Move them from SONIC_BOOKWORM_DOCKERS to SONIC_TRIXIE_DOCKERS to align with the ongoing container migration to Debian 13 (Trixie).

docker-telemetry-watchdog and docker-sonic-telemetry are both FROM docker-sonic-gnmi, so they must follow it to Trixie.

This follows the same pattern as PR #25942 (Brcm containers migrate to trixie) and builds on the Trixie base layers added in PR #25184.

Containers migrated

docker-sonic-gnmi
docker-gnmi-sidecar
docker-gnmi-watchdog
docker-telemetry-watchdog
docker-sonic-telemetry

sonic-gnmi submodule update (a86eb43 → 181841b)

d6f8e05 Disable TLS session tickets to fix FIPS AES-128-CTR panic (Use default table instead of main table for forced_mgmt_routes #635)
181841b Add inline diff coverage check to Azure Pipeline ([platform] Add Arista DCS-7050QX-32S and missing plugins #597)

FIPS fixes

Updated trixie FIPS version from 1.8.0-24-gd744cf2 to 1.8.0-24-gd744cf2-2 to include the Golang FIPS fix with sonic_fips detection and symcryptprovider patches.
Fixed trixie Go FIPS package version from 1.24.4-1 to 1.24.4-1+fips (missing +fips suffix caused armhf build failure).

Testing

Built full VS image locally and deployed to KVM testbed (vlab-01)
Verified gnmi container runs Debian 13 (Trixie)
gnmi/test_gnmi_stress.py: 1 passed
telemetry/test_telemetry_cert_rotation.py: 4 passed

Signed-off-by: Dawei Huang

…i-watchdog to Debian Trixie Update base image references from docker-config-engine-bookworm to docker-config-engine-trixie for all three gnmi-related containers. Move them from SONIC_BOOKWORM_DOCKERS to SONIC_TRIXIE_DOCKERS to align with the ongoing container migration to Debian 13 (Trixie). This follows the same pattern as PR sonic-net#25942 (Brcm containers migrate to trixie) and builds on the Trixie base layers added in PR sonic-net#25184. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

docker-telemetry-watchdog is FROM docker-sonic-gnmi, so it must follow docker-sonic-gnmi to Trixie. Without this, building the bookworm target fails because docker-sonic-gnmi is now a Trixie docker and its -load target is not generated for the bookworm build. Verified: docker-telemetry-watchdog.gz builds successfully under BLDENV=trixie with the Trixie slave container. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

docker-sonic-telemetry is FROM docker-sonic-gnmi (twins), so it must follow docker-sonic-gnmi to Trixie. Also carries forward the docker-telemetry-watchdog Trixie migration from the previous commit for the same reason. Verified: docker-sonic-telemetry.gz builds successfully under BLDENV=trixie with the Trixie slave container. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

Cherry-pick the FIPS version bump from PR sonic-net#26431 to pick up the rebuilt trixie FIPS Go packages with sonic_fips detection and symcryptprovider patches correctly applied. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

mssonicbld · 2026-04-01T02:36:00Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-04-01T02:36:14Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

This PR migrates gNMI/telemetry Docker build rules and Dockerfile base images from Debian bookworm to Debian trixie within the SONiC buildimage ruleset, and updates the trixie FIPS package version pin.

Changes:

Switch gNMI/telemetry Docker images (and watchdog/sidecar variants) to use trixie config-engine base images and trixie docker lists.
Update distro-specific docker list registration from SONIC_BOOKWORM_* to SONIC_TRIXIE_* for the affected images.
Bump FIPS_VERSION for BLDENV=trixie.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
rules/sonic-fips.mk	Updates trixie FIPS version pin.
rules/docker-telemetry.mk	Registers telemetry docker images under trixie docker lists.
rules/docker-telemetry-watchdog.mk	Registers telemetry-watchdog docker images under trixie docker lists.
rules/docker-gnmi.mk	Switches gNMI debug deps/load-dockers to trixie config-engine and registers under trixie lists.
rules/docker-gnmi-watchdog.mk	Switches gNMI-watchdog load docker to trixie config-engine and registers under trixie lists.
rules/docker-gnmi-sidecar.mk	Switches gNMI-sidecar load docker to trixie config-engine and registers under trixie lists.
dockers/docker-sonic-gnmi/Dockerfile.j2	Changes gNMI image base from config-engine-bookworm to config-engine-trixie.
dockers/docker-gnmi-watchdog/Dockerfile.j2	Changes builder/runtime base images from config-engine-bookworm to config-engine-trixie.
dockers/docker-gnmi-sidecar/Dockerfile.j2	Changes gNMI-sidecar image base from config-engine-bookworm to config-engine-trixie.

Copilot · 2026-04-01T02:40:17Z

rules/docker-telemetry-watchdog.mk

 SONIC_DOCKER_IMAGES += $(DOCKER_TELEMETRY_WATCHDOG)
-SONIC_BOOKWORM_DOCKERS += $(DOCKER_TELEMETRY_WATCHDOG)
+SONIC_TRIXIE_DOCKERS += $(DOCKER_TELEMETRY_WATCHDOG)
 SONIC_INSTALL_DOCKER_IMAGES += $(DOCKER_TELEMETRY_WATCHDOG)

 SONIC_DOCKER_DBG_IMAGES += $(DOCKER_TELEMETRY_WATCHDOG_DBG)
-SONIC_BOOKWORM_DBG_DOCKERS += $(DOCKER_TELEMETRY_WATCHDOG_DBG)
+SONIC_TRIXIE_DBG_DOCKERS += $(DOCKER_TELEMETRY_WATCHDOG_DBG)
 SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_TELEMETRY_WATCHDOG_DBG)


docker-telemetry-watchdog is now only added to SONIC_TRIXIE_DOCKERS, but it is still unconditionally added to SONIC_INSTALL_DOCKER_IMAGES / SONIC_INSTALL_DOCKER_DBG_IMAGES. In a bookworm build, this will make installers request docker-telemetry-watchdog.gz while the docker target is not generated (since DOCKER_IMAGES := $(SONIC_BOOKWORM_DOCKERS)), leading to a missing-target build failure. Gate the install lists by BLDENV==trixie (or keep the image in the bookworm docker list as well) so bookworm builds remain consistent.

Copilot · 2026-04-01T02:40:17Z

rules/docker-gnmi-sidecar.mk

 SONIC_DOCKER_IMAGES += $(DOCKER_GNMI_SIDECAR)
-SONIC_BOOKWORM_DOCKERS += $(DOCKER_GNMI_SIDECAR)
+SONIC_TRIXIE_DOCKERS += $(DOCKER_GNMI_SIDECAR)
 SONIC_INSTALL_DOCKER_IMAGES += $(DOCKER_GNMI_SIDECAR)

 SONIC_DOCKER_DBG_IMAGES += $(DOCKER_GNMI_SIDECAR_DBG)
-SONIC_BOOKWORM_DBG_DOCKERS += $(DOCKER_GNMI_SIDECAR_DBG)
+SONIC_TRIXIE_DBG_DOCKERS += $(DOCKER_GNMI_SIDECAR_DBG)
 SONIC_INSTALL_DOCKER_DBG_IMAGES += $(DOCKER_GNMI_SIDECAR_DBG)


docker-gnmi-sidecar is now only added to SONIC_TRIXIE_DOCKERS, but it is still unconditionally included in SONIC_INSTALL_DOCKER_IMAGES / SONIC_INSTALL_DOCKER_DBG_IMAGES. For bookworm builds, this will cause installers to depend on an image that isn't part of DOCKER_IMAGES (derived from SONIC_BOOKWORM_DOCKERS), resulting in a missing-target build failure. Gate installation on BLDENV==trixie (or provide a bookworm variant) to keep installer docker lists aligned with buildable docker images.

Copilot · 2026-04-01T02:40:18Z

rules/docker-gnmi-watchdog.mk

 SONIC_DOCKER_IMAGES += $(DOCKER_GNMI_WATCHDOG)
-SONIC_BOOKWORM_DOCKERS += $(DOCKER_GNMI_WATCHDOG)
+SONIC_TRIXIE_DOCKERS += $(DOCKER_GNMI_WATCHDOG)
 ifeq ($(INCLUDE_SYSTEM_GNMI), y)
 SONIC_INSTALL_DOCKER_IMAGES += $(DOCKER_GNMI_WATCHDOG)
 endif


docker-gnmi-watchdog is now only added to SONIC_TRIXIE_DOCKERS/SONIC_TRIXIE_DBG_DOCKERS. If INCLUDE_SYSTEM_GNMI=y is enabled in a bookworm build, the installer lists will include this image but the bookworm docker target list (DOCKER_IMAGES := $(SONIC_BOOKWORM_DOCKERS)) will not, causing a missing-target build failure. Consider additionally gating the SONIC_INSTALL_DOCKER_IMAGES additions on BLDENV==trixie (or keeping the image in the bookworm lists) so enabling GNMI doesn’t break bookworm builds.

Copilot · 2026-04-01T02:40:18Z

rules/docker-gnmi.mk

 SONIC_DOCKER_IMAGES += $(DOCKER_GNMI)
-SONIC_BOOKWORM_DOCKERS += $(DOCKER_GNMI)
+SONIC_TRIXIE_DOCKERS += $(DOCKER_GNMI)
 ifeq ($(INCLUDE_SYSTEM_GNMI), y)
 SONIC_INSTALL_DOCKER_IMAGES += $(DOCKER_GNMI)
 endif


docker-sonic-gnmi is now marked as a trixie-only docker (SONIC_TRIXIE_DOCKERS) and its debug deps/load-dockers reference DOCKER_CONFIG_ENGINE_TRIXIE. If INCLUDE_SYSTEM_GNMI=y is enabled for a bookworm build, the installer docker lists will include this image but it will not be part of the bookworm docker build target set (DOCKER_IMAGES := $(SONIC_BOOKWORM_DOCKERS)), leading to a missing-target build failure. Gate GNMI installation on BLDENV==trixie (or provide a bookworm build path) to avoid breaking existing bookworm builds when GNMI is enabled.

yijingyan2 · 2026-04-01T06:25:13Z

/azpw ms_conflict

Points sonic-gnmi submodule to hdwhdw/sonic-gnmi branch fix-fips-session-ticket-panic which disables TLS session tickets. The SymCrypt FIPS provider does not implement AES-128-CTR cipher mode. When sonic_fips=1 is set in the kernel cmdline, Go's FIPS runtime enables FIPS-only cipher fetching, causing EVP_CIPHER_fetch to return NULL for AES-128-CTR. TLS 1.3 session ticket encryption uses this cipher mode, resulting in a panic that crashes the gNMI server during certificate rotation. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

mssonicbld · 2026-04-01T14:14:25Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-04-01T14:14:41Z

Azure Pipelines successfully started running 1 pipeline(s).

yxieca · 2026-04-01T19:17:42Z

/azpw ms_conflict

sonic-net/sonic-gnmi#635 has been merged. Point the submodule back to sonic-net/sonic-gnmi master instead of the fork branch. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

The Go FIPS package version for trixie was missing the +fips suffix (1.24.4-1 instead of 1.24.4-1+fips), causing the armhf pipeline build to fail when fetching the package. All other FIPS packages already use the +fips suffix consistently. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

mssonicbld · 2026-04-02T02:14:48Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-04-02T02:15:00Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

yxieca · 2026-04-02T03:08:18Z

/azpw ms_conflict

…tion Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

mssonicbld · 2026-04-02T13:40:26Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-04-02T13:40:42Z

Azure Pipelines successfully started running 1 pipeline(s).

saiarcot895 · 2026-04-02T21:53:21Z

Please add the commits that are being brought in in the submodule update in the description above.

hdwhdw · 2026-04-04T01:01:49Z

Done, updated the description with the sonic-gnmi submodule commits (a86eb43 → 181841b).

hdwhdw added 4 commits March 31, 2026 21:35

Update trixie FIPS version to include Golang FIPS fix

3b8c3ef

Cherry-pick the FIPS version bump from PR sonic-net#26431 to pick up the rebuilt trixie FIPS Go packages with sonic_fips detection and symcryptprovider patches correctly applied. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

hdwhdw requested review from lguohan, qiluo-msft and xumia as code owners April 1, 2026 02:35

Copilot AI review requested due to automatic review settings April 1, 2026 02:35

Copilot started reviewing on behalf of hdwhdw April 1, 2026 02:36 View session

hdwhdw changed the title ~~Gnmi trixie migration~~ [gnmi] Migrate gnmi, telemetry, and watchdog containers to Debian Trixie Apr 1, 2026

Copilot AI reviewed Apr 1, 2026

View reviewed changes

This was referenced Apr 1, 2026

Disable TLS session tickets to fix FIPS AES-128-CTR panic sonic-net/sonic-gnmi#635

Merged

[gnmi] Migrate gnmi, telemetry, and watchdog containers to Debian Trixie #25957

Closed

saiarcot895 mentioned this pull request Apr 1, 2026

Container upgrades to Trixie sonic-net/SONiC#2169

Open

hdwhdw mentioned this pull request Apr 1, 2026

Go 1.24 FIPS: loadCipher overwrites valid legacy cipher with nil when EVP_CIPHER_fetch fails under SymCrypt sonic-net/sonic-fips#86

Open

hdwhdw added 2 commits April 1, 2026 21:14

Update sonic-gnmi submodule to upstream with session ticket fix

8654720

sonic-net/sonic-gnmi#635 has been merged. Point the submodule back to sonic-net/sonic-gnmi master instead of the fork branch. Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

Copilot AI review requested due to automatic review settings April 2, 2026 02:14

Copilot started reviewing on behalf of hdwhdw April 2, 2026 02:15 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

Merge remote-tracking branch 'upstream/master' into gnmi-trixie-migra…

4a8f6d2

…tion Signed-off-by: Dawei Huang <daweihuang@microsoft.com>

hdwhdw requested review from saiarcot895 and zbud-msft April 2, 2026 21:30

saiarcot895 mentioned this pull request Apr 3, 2026

Migrate sonic-mgmt-framework container to Debian Trixie #26548

Open

Conversation

hdwhdw commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Containers migrated

sonic-gnmi submodule update (a86eb43 → 181841b)

FIPS fixes

Testing

Uh oh!

mssonicbld commented Apr 1, 2026

Uh oh!

azure-pipelines bot commented Apr 1, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

yijingyan2 commented Apr 1, 2026

Uh oh!

mssonicbld commented Apr 1, 2026

Uh oh!

azure-pipelines bot commented Apr 1, 2026

Uh oh!

yxieca commented Apr 1, 2026

Uh oh!

mssonicbld commented Apr 2, 2026

Uh oh!

azure-pipelines bot commented Apr 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

yxieca commented Apr 2, 2026

Uh oh!

mssonicbld commented Apr 2, 2026

Uh oh!

azure-pipelines bot commented Apr 2, 2026

Uh oh!

saiarcot895 commented Apr 2, 2026

Uh oh!

hdwhdw commented Apr 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

hdwhdw commented Apr 1, 2026 •

edited

Loading