Release-gated: enable Debian ARM64 Docker images with Citus 15.0

[ihalatci]

Decision and status

BLOCKED ON CITUS 15.0 PACKAGE READINESS. The decision on 2026-09-10 is to wait for the Citus 15.0 release, not backfill Citus 14.2. Do not downgrade existing Docker images or enable Debian ARM64 before the prerequisites below are met.

This issue tracks the remaining work across citusdata/packaging, citusdata/tools, and citusdata/docker. It is a release checklist, not authorization to push, merge, tag, dispatch production workflows, or publish images without maintainer approval.

Already delivered

• Alpine amd64/arm64 images: Add linux/arm64 support to Docker images (Track 1: multi-arch alpine) #382.
• Native ARM64 Citus regression/isolation nightly infrastructure: Add phase-1 native arm64 nightly CI (regress + isolation on ubuntu-24.04-arm) citus#8816.
• The known libc6 ARM64 diversion warning fix: Handle known ARM64 libc6 usr-merge diversion warnings tools#433, released in tools v0.8.40.
• Bullseye retirement, ARM64 signing fixes, and tools-pin adoption on the release branches: Retire Bullseye and fix ARM64 Citus release signing packaging#1233 (Citus), Retire Bullseye and fix ARM64 HLL signing packaging#1226 (HLL), and Retire Bullseye and fix ARM64 TopN signing packaging#1225 (TopN).
• All twelve post-merge ARM64 production jobs succeeded on Bookworm, Trixie, Jammy, and Noble: Citus run, HLL run, and TopN run. The workflows as a whole were red because amd64 publication steps failed; do not describe the complete workflows as green.

The published Citus ARM64 packages are 13.4.0 for PG15-17, not the 14.2.0 for PG17/18 currently pinned by the Debian images. HLL 2.21 and TopN 2.7.1 ARM64 packages exist for PG17/18. Successful publication of these packages does not establish Citus 15.0 readiness or end-to-end image installability.

Release gates

Keep Debian ARM64 enablement blocked until all applicable gates are satisfied:

• Citus 15.0 is released, and the exact source tag, package version, and intended Docker image version are recorded.
• Signed Citus 15.0 ARM64 packages are published in stable citusdata/community for every selected PostgreSQL major and Debian suite. A community-nightlies package or a different Citus version is not a substitute.
• The same stable repository contains the exact ARM64 HLL and TopN versions required by those images, with satisfiable dependencies and expected package/repository signing.
• Each selected official PostgreSQL base image supports linux/arm64, and its actual Debian suite matches the package source.
• The release's package recipes, PostgreSQL matrix, tools pins, and Docker pins agree. In particular, update the release inputs deliberately rather than assuming the current all-citus pkglatest=13.4.0.citus-1 follows a new source tag automatically.

Initial image scope is PostgreSQL 17 and 18. Include a default/latest image only when its selected PostgreSQL major satisfies the same gates. PostgreSQL 19 activation is separately tracked by #387; it is not implicitly included here.

Remaining work, in order

1. Establish exact package and runtime readiness

• Record an availability matrix for image type, PostgreSQL version, Debian suite, Citus/HLL/TopN versions, and architecture.
• Install the exact stable ARM64 packages in clean target environments, retaining normal signature verification and without falling back to amd64 or nightly packages.
• Confirm PostgreSQL startup/connectivity, CREATE EXTENSION for Citus/HLL/TopN, extension versions, and a small distributed-query smoke scenario on ARM64. Retain evidence for the release version, not only an unrelated main-branch nightly.

2. Enable the approved Debian image types in tools

• Make the minimum change to packaging_automation/publish_docker.py / get_platforms in citusdata/tools. Tools v0.8.40 currently enables multi-arch only for Alpine.
• Preserve the existing DOCKER_BUILD_MULTI_ARCH opt-in and amd64 default, existing Alpine behavior, and excluded image types. Do not accidentally enable unsupported or nightly image types.
• Cover the selected image types and flag-on/flag-off behavior in the existing tests.
• Review and merge the change, then publish an approved tools tag containing the platform-map change and the existing ARM64 packaging fixes.

3. Adopt and publish in Docker

• Coordinate with Switch image matrices to PostgreSQL 17/18 and adopt tools v0.8.39 #386, the PG17/18 image-matrix migration, so its older tools-pin change does not overwrite the newly adopted tag.
• Align Citus 15.0 image content and package pins with the availability matrix, and adopt the approved tools tag in the consuming workflows.
• Before invoking image regeneration, confirm which PostgreSQL version the generator selects for default/latest and Alpine. Respect BLOCKED: PG19 GA follow-up steps to complete PostgreSQL 19 support #387's ordering guard: do not promote a PG19 beta into stable images. PG17/18 image delivery need not wait for PG19 when those images independently satisfy their gates.
• Build the selected Debian images for linux/amd64 and linux/arm64, with native ARM64 runtime coverage and retained amd64 behavior.
• Publish the approved release and floating tags through the normal release process.
• Confirm the published manifests contain both architectures; pull and run each architecture and record the resulting digests and extension versions.
• Update the supported-image documentation and original ARM64 requests with the exact delivered tags and remaining exclusions.

Completion criteria

This issue is complete only when the selected Citus 15.0 Debian images are published and usable on both architectures, with exact package/install/runtime and manifest evidence linked here. Merged PRs, compilation alone, or package-index presence alone are insufficient.

Do not fold a Citus 14.2 backfill, unrelated Citus bug fixes, or PG19 enablement into this work.

Related tracking

• Original request: Please provide an arm64 Docker image as well citus#8612.
• Earlier Docker ARM64 requests: Provide arm64 docker image for running on Apple M1/M2 #309 and official docker hub images don't work on apple silicon #224.
• PG17/18 image preparation: Switch image matrices to PostgreSQL 17/18 and adopt tools v0.8.39 #386.
• Separate PG19 release gates and regeneration ordering: BLOCKED: PG19 GA follow-up steps to complete PostgreSQL 19 support #387.