From 039a6ecf9e150eccadba82639258dba854b7a5ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= <pawel.gronowski@docker.com>
Date: Fri, 17 Jul 2026 17:20:06 +0200
Subject: [PATCH] Dockerfile: Handle armel linux-libc-dev version skew
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Debian's Bookworm LTS transition dropped armel from the architectures
receiving security updates: https://www.debian.org/News/2026/20260712

The regular archive still provides linux-libc-dev 6.1.176-1 for armel,
while supported native architectures receive 6.1.177-1 from
bookworm-security.
Because linux-libc-dev is `Multi-Arch: same`, APT does not choose the
armel package transitively for libc6-dev when the native package has a
newer candidate.

Request linux-libc-dev explicitly in each Linux cross-build stage to
keep the target headers aligned with the installed native version.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
(cherry picked from commit 547dcf4d23b7052b8475d6414d6079d6c57022b0)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
---
 Dockerfile | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index bb0f177fdc..98cbf56c7e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -259,6 +259,7 @@ RUN --mount=type=cache,sharing=locked,id=moby-runc-aptlib,target=/var/lib/apt \
         apt-get update && xx-apt-get install -y --no-install-recommends \
             gcc \
             libc6-dev \
+            linux-libc-dev \
             libseccomp-dev \
             pkg-config
 ARG DOCKER_STATIC
@@ -304,6 +305,7 @@ RUN --mount=type=cache,sharing=locked,id=moby-tini-aptlib,target=/var/lib/apt \
         xx-apt-get install -y --no-install-recommends \
             gcc \
             libc6-dev \
+            linux-libc-dev \
             pkg-config
 RUN --mount=from=tini-src,src=/usr/src/tini,rw \
     --mount=type=cache,target=/root/.cache/go-build,id=tini-build-$TARGETPLATFORM <<EOT
@@ -333,6 +335,7 @@ RUN --mount=type=cache,sharing=locked,id=moby-rootlesskit-aptlib,target=/var/lib
         apt-get update && xx-apt-get install -y --no-install-recommends \
             gcc \
             libc6-dev \
+            linux-libc-dev \
             pkg-config
 ARG DOCKER_STATIC
 RUN --mount=from=rootlesskit-src,src=/usr/src/rootlesskit,rw \
@@ -541,6 +544,7 @@ RUN --mount=type=cache,sharing=locked,id=moby-build-aptlib,target=/var/lib/apt \
         xx-apt-get install --no-install-recommends -y \
             gcc \
             libc6-dev \
+            linux-libc-dev \
             libnftables-dev \
             libseccomp-dev \
             libsystemd-dev \