From bb38bf74144b69130acffdd479db31607a14b339 Mon Sep 17 00:00:00 2001
From: Tom Proctor <tomhjp@users.noreply.github.com>
Date: Wed, 17 Sep 2025 20:22:24 +0100
Subject: [PATCH] docker: bump alpine v3.19 -> 3.22 (#17155)

Updates #15328

Change-Id: Ib33baf8756b648176dce461b25169e079cbd5533

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
---
 ALPINE.txt      | 2 +-
 Dockerfile      | 6 +++---
 Dockerfile.base | 8 ++++----
 build_docker.sh | 2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/ALPINE.txt b/ALPINE.txt
index 318956c3d..93a84c380 100644
--- a/ALPINE.txt
+++ b/ALPINE.txt
@@ -1 +1 @@
-3.19
\ No newline at end of file
+3.22
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index bd0f2840f..c546cf657 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -71,10 +71,10 @@ RUN GOARCH=$TARGETARCH go install -ldflags="\
       -X tailscale.com/version.gitCommitStamp=$VERSION_GIT_HASH" \
       -v ./cmd/tailscale ./cmd/tailscaled ./cmd/containerboot
 
-FROM alpine:3.19
+FROM alpine:3.22
 RUN apk add --no-cache ca-certificates iptables iproute2 ip6tables
-RUN rm /sbin/iptables && ln -s /sbin/iptables-legacy /sbin/iptables
-RUN rm /sbin/ip6tables && ln -s /sbin/ip6tables-legacy /sbin/ip6tables
+RUN ln -s /sbin/iptables-legacy /sbin/iptables
+RUN ln -s /sbin/ip6tables-legacy /sbin/ip6tables
 
 COPY --from=build-env /go/bin/* /usr/local/bin/
 # For compat with the previous run.sh, although ideally you should be
diff --git a/Dockerfile.base b/Dockerfile.base
index b7e79a43c..6c3c8ed08 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -1,12 +1,12 @@
 # Copyright (c) Tailscale Inc & AUTHORS
 # SPDX-License-Identifier: BSD-3-Clause
 
-FROM alpine:3.19
+FROM alpine:3.22
 RUN apk add --no-cache ca-certificates iptables iptables-legacy iproute2 ip6tables iputils
-# Alpine 3.19 replaces legacy iptables with nftables based implementation.  We
+# Alpine 3.19 replaced legacy iptables with nftables based implementation.  We
 # can't be certain that all hosts that run Tailscale containers currently
 # suppport nftables, so link back to legacy for backwards compatibility reasons.
 # TODO(irbekrm): add some way how to determine if we still run on nodes that
 # don't support nftables, so that we can eventually remove these symlinks.
-RUN rm /sbin/iptables && ln -s /sbin/iptables-legacy /sbin/iptables
-RUN rm /sbin/ip6tables && ln -s /sbin/ip6tables-legacy /sbin/ip6tables
+RUN ln -s /sbin/iptables-legacy /sbin/iptables
+RUN ln -s /sbin/ip6tables-legacy /sbin/ip6tables
diff --git a/build_docker.sh b/build_docker.sh
index bdeaa8659..37f00bf53 100755
--- a/build_docker.sh
+++ b/build_docker.sh
@@ -26,7 +26,7 @@ eval "$(./build_dist.sh shellvars)"
 
 DEFAULT_TARGET="client"
 DEFAULT_TAGS="v${VERSION_SHORT},v${VERSION_MINOR}"
-DEFAULT_BASE="tailscale/alpine-base:3.19"
+DEFAULT_BASE="tailscale/alpine-base:3.22"
 # Set a few pre-defined OCI annotations. The source annotation is used by tools such as Renovate that scan the linked
 # Github repo to find release notes for any new image tags. Note that for official Tailscale images the default
 # annotations defined here will be overriden by release scripts that call this script.