When you say you “got stung”, what did you encounter?

Our dockerfile executes

box task run compile.cfc

that call's lucee admin's createArchiveFromMapping() to compile cfc/cfm into a .lar archive, it appears it embeds the extension dependancies of the version of lucee embedded in the box server, which when it got bumped, was no longer the same as our specific application server ENV BOX_SERVER_APP_CFENGINE=lucee-light@5.3.9.133 so part of our service which used the s3 extension no longer had the version it wanted (because v5.3.9.160 wants a new s3 extension) so it started failing

Ah, so it was just the Lucee version bundled with CommandBox that was at issue. Yes, you will probably need to pin that to 3.5.4 for now.

so the tag

:jdk-alpine-3.5.4

has a fixed version of commandbox? what does the version number match to? alpine's version?

That would be CommandBox 5.5.2. You can see the version bumps in the changelog: https://github.com/Ortus-Solutions/docker-commandbox/blob/development/changelog.md

The version number is independent and is not coupled to a binary version. This is so we can increment changes more flexibly

Thanks for the changelog link, I'll bookmark this so I can be better at checking compatibility

Yes. We use the eclipse-temurin builds as the base image, so the alpine kernel would be what they are using: https://hub.docker.com/layers/library/eclipse-temurin/11-jre-alpine/images/sha256-dc28ac69ce6118cb9a4da85de8de7592d3a006af971cf398f1280590d30e82bc?context=explore

thanks very much for the help @jclausen

Any time! 🙂