InseeFrLab · avouacr · Sep 20, 2026 · Sep 19, 2026 · Sep 19, 2026 · Sep 19, 2026
diff --git a/.github/workflows/main-workflow-template.yml b/.github/workflows/main-workflow-template.yml
@@ -12,9 +12,10 @@ on:
         required: true
         type: string
       base_image:
-        description: Name of the base image
-        required: true
+        description: Name of the base image (empty for base, whose external base images come from versions.env)
+        required: false
         type: string
+        default: ""
       languages:
         description: Languages of the image, which select the versions read from versions.env (python, r or r-python; empty for base)
         required: false
@@ -39,15 +40,13 @@ jobs:
     steps:
     - name: Check out code 
       uses: actions/checkout@v7
-
     - name: Set up Python
       uses: actions/setup-python@v7 
       with:
         python-version: '3.14'
-
     - id: set-matrix
       run: |
-        python3 utils/generate_matrix.py --input_image ${{ inputs.base_image }} --output_image ${{ inputs.image }} \
+        python3 utils/generate_matrix.py --input_image "${{ inputs.base_image }}" --output_image ${{ inputs.image }} \
             --languages "${{ inputs.languages }}" --spark ${{ inputs.spark }} --build_gpu ${{ inputs.build_gpu }}
   docker:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/main-workflow.yml b/.github/workflows/main-workflow.yml
@@ -15,7 +15,6 @@ jobs:
     with:
       image: base
       context: base
-      base_image: ubuntu:24.04
     secrets: inherit
   python-minimal:
     needs: [base]

diff --git a/python-minimal/Dockerfile b/python-minimal/Dockerfile
@@ -3,7 +3,7 @@ FROM $BASE_IMAGE
 
 LABEL maintainer="InseeFrLab <innovation@insee.fr>"
 
-ARG PYTHON_VERSION="3.13.15"
+ARG PYTHON_VERSION="3.14.7"
 ENV PYTHON_VERSION=${PYTHON_VERSION}
 
 # Install Python separately from system installation to avoid conflicts

diff --git a/r-python-julia/Dockerfile b/r-python-julia/Dockerfile
@@ -3,7 +3,7 @@ FROM $BASE_IMAGE
 
 LABEL maintainer="InseeFrLab <innovation@insee.fr>"
 
-ARG PYTHON_VERSION="3.13.15"
+ARG PYTHON_VERSION="3.14.7"
 ENV PYTHON_VERSION=${PYTHON_VERSION}
 
 # Install Python separately from system installation to avoid conflicts

diff --git a/renovate.json b/renovate.json
@@ -79,17 +79,29 @@
       "depTypeTemplate": "spark"
     },
     {
-      "description": "CUDA base image of the GPU variants (versions.env)",
+      "description": "Base image of the GPU variants (versions.env)",
       "customType": "regex",
       "managerFilePatterns": [
         "/^versions\\.env$/"
       ],
       "matchStrings": [
-        "CUDA_BASE_IMAGE=\"(?<depName>[^:\"]+):(?<currentValue>[^\"]+)\""
+        "BASE_IMAGE_GPU=\"(?<depName>[^:\"]+):(?<currentValue>[^\"]+)\""
       ],
       "datasourceTemplate": "docker",
       "depTypeTemplate": "cuda"
     },
+    {
+      "description": "Base image of the CPU variants (versions.env)",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^versions\\.env$/"
+      ],
+      "matchStrings": [
+        "BASE_IMAGE_CPU=\"(?<depName>[^:\"]+):(?<currentValue>[^\"]+)\""
+      ],
+      "datasourceTemplate": "docker",
+      "depTypeTemplate": "base-image"
+    },
     {
       "description": "Tools downloaded by install scripts and CI actions, pinned with a '# renovate: datasource=... depName=...' comment above a <TOOL>_VERSION=\"x.y.z\" line",
       "customType": "regex",

diff --git a/utils/build_chain.py b/utils/build_chain.py
@@ -2,7 +2,7 @@
 import logging
 import subprocess
 
-from versions import read_versions
+from utils.generate_matrix import read_versions
 
 logging.basicConfig(
     level=logging.INFO,
@@ -46,7 +46,7 @@ def build_chain(chain_name, r_version, py_version, spark_version, gpu, no_test,
         # Specify base image for each build step
         if i == 0:
             # First step : define external base images
-            previous_image = read_versions()["CUDA_BASE_IMAGE"] if gpu else "ubuntu:24.04"
+            previous_image = read_versions()["BASE_IMAGE_GPU"] if gpu else read_versions()["BASE_IMAGE_CPU"]
         else:
             # Intermediary and final steps : use previous built tag as base image
             previous_image = tag

diff --git a/utils/build_chains.sh b/utils/build_chains.sh
@@ -11,24 +11,23 @@ DOCKER_BUILD_ARGS=""
 
 # Build process
 
-# Maintained versions (PYTHON_VERSION_1/2, R_VERSION_1/2, SPARK_VERSION)
-# shellcheck source=versions.env
-source "$(dirname "$0")/../versions.env"
+# Load maintained versions
+source "versions.env"
 
 PYTHON_VERSIONS=("$PYTHON_VERSION_1" "$PYTHON_VERSION_2")
 R_VERSIONS=("$R_VERSION_1" "$R_VERSION_2")
 
 for py_ver in "${PYTHON_VERSIONS[@]}"; do
-  python3 utils/build_chain.py --chain vscode-python --py_version $py_ver $DOCKER_BUILD_ARGS
-  python3 utils/build_chain.py --chain vscode-pytorch --py_version $py_ver --gpu $DOCKER_BUILD_ARGS
-  python3 utils/build_chain.py --chain jupyter-pyspark --py_version $py_ver --spark_version $SPARK_VERSION $DOCKER_BUILD_ARGS
+  uv run python3 -m utils.build_chain --chain vscode-python --py_version $py_ver $DOCKER_BUILD_ARGS
+  uv run python3 -m utils.build_chain --chain vscode-pytorch --py_version $py_ver --gpu $DOCKER_BUILD_ARGS
+  uv run python3 -m utils.build_chain --chain jupyter-pyspark --py_version $py_ver --spark_version $SPARK_VERSION $DOCKER_BUILD_ARGS
 done
 
 for r_ver in "${R_VERSIONS[@]}"; do
-  python3 utils/build_chain.py --chain rstudio --r_version $r_ver $DOCKER_BUILD_ARGS
-  python3 utils/build_chain.py --chain sparkr --r_version $r_ver --spark_version $SPARK_VERSION $DOCKER_BUILD_ARGS
+  uv run python3 -m utils.build_chain --chain rstudio --r_version $r_ver $DOCKER_BUILD_ARGS
+  uv run python3 -m utils.build_chain --chain sparkr --r_version $r_ver --spark_version $SPARK_VERSION $DOCKER_BUILD_ARGS
 done
 
 # r-python-julia images are built with only latest versions of R & Python
-python3 utils/build_chain.py --chain rstudio-r-python-julia --r_version ${R_VERSIONS[0]} --py_version ${PYTHON_VERSIONS[0]} $DOCKER_BUILD_ARGS
-python3 utils/build_chain.py --chain jupyter-r-python-julia --r_version ${R_VERSIONS[0]} --py_version ${PYTHON_VERSIONS[0]} $DOCKER_BUILD_ARGS
+uv run python3 -m utils.build_chain --chain rstudio-r-python-julia --r_version ${R_VERSIONS[0]} --py_version ${PYTHON_VERSIONS[0]} $DOCKER_BUILD_ARGS
+uv run python3 -m utils.build_chain --chain jupyter-r-python-julia --r_version ${R_VERSIONS[0]} --py_version ${PYTHON_VERSIONS[0]} $DOCKER_BUILD_ARGS
diff --git a/utils/generate_matrix.py b/utils/generate_matrix.py
@@ -9,7 +9,7 @@
 DH_ORGA = "inseefrlab"
 IMAGES_PREFIX = "onyxia"
 TODAY_DATE = datetime.now(UTC).strftime("%Y.%m.%d")
-VERSIONS_FILE = Path(__file__).resolve().parent.parent / "versions.env"
+VERSIONS_FILE = "versions.env"
 
 
 def generate_matrix(versions, input_image, output_image, spark_version, gpu_options, version_prefix):
@@ -77,10 +77,10 @@ def generate_r_python_julia_matrix(r_version, py_version, input_image, output_im
     return matrix
 
 
-def read_versions(path=VERSIONS_FILE):
+def read_versions():
     """Parse the KEY="value" lines of versions.env into a dict, ignoring comments and blank lines."""
     versions = {}
-    for line in path.read_text().splitlines():
+    for line in Path(VERSIONS_FILE).read_text().splitlines():
         line = line.strip()
         if line and not line.startswith("#"):
             key, value = line.split("=", 1)
@@ -108,12 +108,12 @@ def read_versions(path=VERSIONS_FILE):
         onyxia_base_tag = f"{IMAGES_PREFIX}-base:latest"
         matrix = [
             {
-                "base_image_tag": args.input_image,
+                "base_image_tag": versions["BASE_IMAGE_CPU"],
                 "output_image_main_tag": f"{DH_ORGA}/{onyxia_base_tag}",
                 "output_image_tags": f"{DH_ORGA}/{onyxia_base_tag},{DH_ORGA}/{onyxia_base_tag}-{TODAY_DATE}",
             },
             {
-                "base_image_tag": versions["CUDA_BASE_IMAGE"],
+                "base_image_tag": versions["BASE_IMAGE_GPU"],
                 "output_image_main_tag": f"{DH_ORGA}/{onyxia_base_tag}-gpu",
                 "output_image_tags": f"{DH_ORGA}/{onyxia_base_tag}-gpu,{DH_ORGA}/{onyxia_base_tag}-gpu-{TODAY_DATE}",
             },

diff --git a/versions.env b/versions.env
@@ -1,11 +1,12 @@
 # Single source of truth for the versions actively maintained in the images, read by the CI build matrix
-# (utils/generate_matrix.py) and by local builds (utils/build_chains.sh, utils/build_chain.py).
+# (utils/generate_matrix.py) and by local build scripts (utils/build_chains.sh, utils/build_chain.py).
 # Updated by Renovate, which also keeps the ARG defaults of the Dockerfiles in sync.
 
-CUDA_BASE_IMAGE="nvidia/cuda:12.6.3-cudnn-devel-ubuntu24.04"
+BASE_IMAGE_CPU="ubuntu:24.04"
+BASE_IMAGE_GPU="nvidia/cuda:12.6.3-cudnn-devel-ubuntu24.04"
 
-PYTHON_VERSION_1="3.13.15"
-PYTHON_VERSION_2="3.12.14"
+PYTHON_VERSION_1="3.14.7"
+PYTHON_VERSION_2="3.13.15"
 R_VERSION_1="4.6.1"
 R_VERSION_2="4.5.3"
 

diff --git a/vscode/scripts/install-vscode.sh b/vscode/scripts/install-vscode.sh
@@ -2,7 +2,7 @@
 set -eo pipefail
 
 # renovate: datasource=github-releases depName=coder/code-server
-CODE_SERVER_VERSION="4.137.0"
+CODE_SERVER_VERSION="4.138.0"
 
 # Download the official package and verify its checksum
 CODE_SERVER_DEB="code-server_${CODE_SERVER_VERSION}_amd64.deb"