fix(docker): pin bcrypt below 5 so passlib can hash

[official-burak]

Fixes #4180.

bcrypt 5 makes passlib 1.7.4 fail its wraparound self-test, so password_hash('bcrypt') errors in the Docker image even for short passwords. This pins bcrypt>=4,<5 next to passlib in the server, runner, and job images, matching the ansible-core advice.

Confirmed locally: passlib 1.7.4 + bcrypt 5.0.0 raises the 72-byte error; bcrypt 4.x hashes fine.

Summary by CodeRabbit

• Bug Fixes
  • Fixed deployment-related authentication compatibility issues by restricting bcrypt to supported versions.
  • Improved reliability for Ansible and Passlib-based operations across job, runner, and server environments.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: ad951fac-a47b-449e-9903-a69c37ef0bce

📥 Commits

Reviewing files that changed from the base of the PR and between 89a2c01 and 84e7c1c.

📒 Files selected for processing (3)

• deployment/docker/job/Dockerfile
• deployment/docker/runner/Dockerfile
• deployment/docker/server/Dockerfile

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The Docker job, runner, and server images now constrain bcrypt to versions >=4,<5 and document its compatibility requirement with passlib 1.7.4.

Changes

bcrypt compatibility

Layer / File(s)	Summary
Docker dependency pins deployment/docker/{job,runner,server}/Dockerfile	The Ansible-related pip installation steps constrain bcrypt to versions >=4,<5. Comments document the incompatibility between passlib 1.7.4 and bcrypt 5+.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: fiftin

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title 'fix(docker): pin bcrypt below 5 so passlib can hash' directly describes the main change in the changeset. The title clearly identifies that this is a Docker-related fix that pi…
Linked Issues check	✅ Passed	The pull request fully satisfies the requirements from linked issue #4180. The changeset pins bcrypt to >=4,<5 across all three Docker images (server, runner, job), which directly addresses the inco…
Out of Scope Changes check	✅ Passed	All changes in the pull request are in scope. The modifications are limited to three Dockerfile objects (deployment/docker/server/Dockerfile, deployment/docker/runner/Dockerfile, deployment/docker/job…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Title check

Explanation

The pull request title 'fix(docker): pin bcrypt below 5 so passlib can hash' directly describes the main change in the changeset. The title clearly identifies that this is a Docker-related fix that pins the bcrypt dependency below version 5 to resolve passlib compatibility issues. All three Dockerfiles (server, runner, job) implement this exact constraint. The title is concise, specific, and accurately summarizes the primary change from the developer's perspective.

Full details: Linked Issues check

Explanation

The pull request fully satisfies the requirements from linked issue #4180. The changeset pins bcrypt to >=4,<5 across all three Docker images (server, runner, job), which directly addresses the incompatibility between passlib 1.7.4 and bcrypt 5.0.0. This constraint prevents the password_hash('bcrypt') failures documented in the issue by ensuring bcrypt 5.0.0 is never resolved transitively through paramiko. The implementation follows the upstream guidance from ansible-core and matches the resolution strategy used by prometheus-community/ansible.

Full details: Out of Scope Changes check

Explanation

All changes in the pull request are in scope. The modifications are limited to three Dockerfile objects (deployment/docker/server/Dockerfile, deployment/docker/runner/Dockerfile, deployment/docker/job/Dockerfile) and consist only of adding the bcrypt version constraint and explanatory comments. These changes directly correspond to the issue requirement to pin bcrypt below version 5 in the official Docker images. No unrelated modifications are present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}