From 999249248e5c4702b92502ba09b85c5cda13f9b2 Mon Sep 17 00:00:00 2001
From: Alexey Pustovalov <alexey.pustovalov@zabbix.com>
Date: Fri, 17 Jul 2026 18:48:52 +0900
Subject: [PATCH] Using proper way to define Debian repository for Ubuntu based
 web-service

---
 Dockerfiles/agent2/rhel/Dockerfile            |  1 -
 Dockerfiles/web-service/ubuntu/Dockerfile     | 26 ++++++++-----------
 .../conf/etc/apt/preferences.d/chromium.pref  |  4 +--
 .../etc/apt/sources.list.d/debian.sources     | 11 ++++++++
 4 files changed, 24 insertions(+), 18 deletions(-)
 create mode 100644 Dockerfiles/web-service/ubuntu/conf/etc/apt/sources.list.d/debian.sources

diff --git a/Dockerfiles/agent2/rhel/Dockerfile b/Dockerfiles/agent2/rhel/Dockerfile
index 4f25dfff..058f08d6 100644
--- a/Dockerfiles/agent2/rhel/Dockerfile
+++ b/Dockerfiles/agent2/rhel/Dockerfile
@@ -70,7 +70,6 @@ RUN --mount=type=tmpfs,target=/var/lib/dnf/ \
             smartmontools \
             sudo" && \
     microdnf -y install \
-            --disableplugin=subscription-manager \
             --disablerepo="*" \
             --enablerepo="ubi-10-baseos-rpms" \
             --setopt=install_weak_deps=0 \
diff --git a/Dockerfiles/web-service/ubuntu/Dockerfile b/Dockerfiles/web-service/ubuntu/Dockerfile
index 8161b400..eab09e0d 100644
--- a/Dockerfiles/web-service/ubuntu/Dockerfile
+++ b/Dockerfiles/web-service/ubuntu/Dockerfile
@@ -32,24 +32,24 @@ STOPSIGNAL SIGTERM
 
 COPY --from=builder /tmp/zabbix-${ZBX_VERSION}-output/web_service/sbin/zabbix_web_service /usr/sbin/zabbix_web_service
 COPY --from=builder /tmp/zabbix-${ZBX_VERSION}-output/web_service/conf/ ${ZABBIX_CONF_DIR}/
-COPY conf/etc/apt/preferences.d/chromium.pref /etc/apt/preferences.d/chromium.pref
 
 RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
     --mount=type=cache,target=/var/lib/apt/,sharing=locked \
     set -eux && \
-    INSTALL_PKGS="bash \
-            ca-certificates \
-            chromium \
-            chromium-sandbox" && \
-    INSTALL_TEMP_PKGS="gnupg dirmngr gpg gpgconf" && \
+    INSTALL_SYSTEM_PKGS="ca-certificates \
+            debian-archive-keyring" && \
     apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y \
             --no-install-recommends \
-        ${INSTALL_TEMP_PKGS} && \
-    gpg --keyserver keyserver.ubuntu.com --recv-keys 78DBA3BC47EF2265 && \
-    gpg -o /etc/apt/keyrings/debian.gpg --export 78DBA3BC47EF2265 && \
-    echo "deb [signed-by=/etc/apt/keyrings/debian.gpg] http://deb.debian.org/debian trixie main" > /etc/apt/sources.list.d/debian.list && \
-    echo "deb [signed-by=/etc/apt/keyrings/debian.gpg] http://deb.debian.org/debian trixie-updates main" >> /etc/apt/sources.list.d/debian.list && \
+        ${INSTALL_SYSTEM_PKGS}
+
+COPY conf/etc/ /etc/
+
+RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt/,sharing=locked \
+    set -eux && \
+    INSTALL_PKGS="chromium \
+            chromium-sandbox" && \
     apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y \
             --no-install-recommends \
@@ -72,10 +72,6 @@ RUN --mount=type=cache,target=/var/cache/apt/,sharing=locked \
         ${ZABBIX_USER_HOME_DIR}/enc_internal && \
     chown --quiet -R zabbix:0 ${ZABBIX_USER_HOME_DIR}/ && \
     chmod -R g=u ${ZABBIX_USER_HOME_DIR}/ && \
-    DEBIAN_FRONTEND=noninteractive apt-get purge -y \
-        ${INSTALL_TEMP_PKGS} && \
-    rm -rf ~/.gnupg && \
-    apt-get autoremove -y && \
     /usr/sbin/zabbix_web_service -V
 
 RUN --mount=from=entrypoints,target=/tmp/entrypoints,ro \
diff --git a/Dockerfiles/web-service/ubuntu/conf/etc/apt/preferences.d/chromium.pref b/Dockerfiles/web-service/ubuntu/conf/etc/apt/preferences.d/chromium.pref
index fe22a11e..71ad9031 100644
--- a/Dockerfiles/web-service/ubuntu/conf/etc/apt/preferences.d/chromium.pref
+++ b/Dockerfiles/web-service/ubuntu/conf/etc/apt/preferences.d/chromium.pref
@@ -4,11 +4,11 @@ Pin: release a=resolute
 Pin-Priority: 500
 
 Package: *
-Pin: origin "deb.debian.org"
+Pin: release o=Debian
 Pin-Priority: 300
 
 # Pattern includes 'chromium', 'chromium-browser' and similarly
 # named dependencies:
 Package: chromium*
-Pin: origin "deb.debian.org"
+Pin: release o=Debian
 Pin-Priority: 700
diff --git a/Dockerfiles/web-service/ubuntu/conf/etc/apt/sources.list.d/debian.sources b/Dockerfiles/web-service/ubuntu/conf/etc/apt/sources.list.d/debian.sources
new file mode 100644
index 00000000..3b75b70c
--- /dev/null
+++ b/Dockerfiles/web-service/ubuntu/conf/etc/apt/sources.list.d/debian.sources
@@ -0,0 +1,11 @@
+Types: deb
+URIs: https://deb.debian.org/debian
+Suites: trixie trixie-updates
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: https://security.debian.org/debian-security
+Suites: trixie-security
+Components: main
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg