From 9f3b2cddb1c7a355bffb8ea56d193158851f3e25 Mon Sep 17 00:00:00 2001
From: Zach <3724288+zedkipp@users.noreply.github.com>
Date: Thu, 16 Oct 2025 19:04:23 +0000
Subject: [PATCH] fix(dogfood): revert unpin of containerd.io and pin docker-ce
 (#20349)

Previously we unpinned the containerd.io package since the dogfood
template image build was failing due to docker-ce requiring a newer
version of containerd.io. The build was fixed, but some dogfood machines
experienced docker-in-docker problems again because their OS version
didn't have the fixed containerd.io packages available.

This PR first reverts the unpinning of the containerd.io package, and
pins the docker-ce major version for compatibility with the
containerd.io package version we have pinned. Newer versions of
docker-ce have a higher min version of containerd.io. While the
underlying issue that caused us to pin containerd.io is fixed in newer
versions, we can't yet remove the pin because some machines running
dogfood are not yet updated to a version of Linux that have a version of
the fixed package (e.g. ubuntu 20.04).
---
 dogfood/coder/files/etc/apt/preferences.d/containerd | 6 ++++++
 dogfood/coder/files/etc/apt/preferences.d/docker     | 4 ++++
 2 files changed, 10 insertions(+)
 create mode 100644 dogfood/coder/files/etc/apt/preferences.d/containerd

diff --git a/dogfood/coder/files/etc/apt/preferences.d/containerd b/dogfood/coder/files/etc/apt/preferences.d/containerd
new file mode 100644
index 0000000000..ab0b8f9891
--- /dev/null
+++ b/dogfood/coder/files/etc/apt/preferences.d/containerd
@@ -0,0 +1,6 @@
+# Ref: https://github.com/nestybox/sysbox/issues/879
+# We need to pin containerd to a specific version to avoid breaking
+# Docker-in-Docker.
+Package: containerd.io
+Pin: version 1.7.23-1
+Pin-Priority: 1001
diff --git a/dogfood/coder/files/etc/apt/preferences.d/docker b/dogfood/coder/files/etc/apt/preferences.d/docker
index a92c0abb03..91dcb2b37f 100644
--- a/dogfood/coder/files/etc/apt/preferences.d/docker
+++ b/dogfood/coder/files/etc/apt/preferences.d/docker
@@ -4,8 +4,12 @@ Pin: origin download.docker.com
 Pin-Priority: 1
 
 # Docker Community Edition
+# We need to pin docker-ce to a specific version because containerd is pinned
+# to an older version. Newer major versions of docker-ce require a version of
+# containerd.io greater than our pinned version.
 Package: docker-ce
 Pin: origin download.docker.com
+Pin: version 5:27.*
 Pin-Priority: 500
 
 # Docker command-line tool