build(postgres): add SUPABASE_POSTGRES_TAG support for image builds

Introduces the SUPABASE_POSTGRES_TAG variable to allow explicit control over the Supabase Postgres base image tag in Docker builds. Updates the Makefile, Dockerfile, and documentation to support and document this new build argument, improving flexibility for building custom images.

Author: andinux

docker/Makefile.postgresql

@@ -123,6 +123,7 @@ DOCKER_TAG ?= latest
 DOCKER_BUILD_ARGS ?=
 SUPABASE_CLI_IMAGE ?= $(shell docker ps --format '{{.Image}} {{.Names}}' | awk '/supabase_db/ {print $$1; exit}')
 SUPABASE_CLI_DOCKERFILE ?= docker/postgresql/Dockerfile.supabase
+SUPABASE_POSTGRES_TAG ?= 17.6.1.071
 SUPABASE_WORKDIR ?=
 SUPABASE_WORKDIR_ARG = $(if $(SUPABASE_WORKDIR),--workdir $(SUPABASE_WORKDIR),)
 SUPABASE_DB_HOST ?= 127.0.0.1
@@ -237,13 +238,17 @@ postgres-docker-shell:
 # Build CloudSync into the Supabase CLI postgres image tag
 postgres-supabase-build:
 	@echo "Building CloudSync image for Supabase CLI..."
-	@if [ -z "$(SUPABASE_CLI_IMAGE)" ]; then \
+	@tmp_dockerfile="$$(mktemp /tmp/cloudsync-supabase-cli.XXXXXX)"; \
+	src_dockerfile="$(SUPABASE_CLI_DOCKERFILE)"; \
+	supabase_cli_image="$(SUPABASE_CLI_IMAGE)"; \
+	if [ -z "$$supabase_cli_image" ]; then \
+		supabase_cli_image="public.ecr.aws/supabase/postgres:$(SUPABASE_POSTGRES_TAG)"; \
+	fi; \
+	if [ -z "$$supabase_cli_image" ]; then \
 		echo "Error: Supabase CLI postgres image not found."; \
 		echo "Run 'supabase start' first, or set SUPABASE_CLI_IMAGE=public.ecr.aws/supabase/postgres:<tag>."; \
 		exit 1; \
-	fi
-	@tmp_dockerfile="$$(mktemp /tmp/cloudsync-supabase-cli.XXXXXX)"; \
-	src_dockerfile="$(SUPABASE_CLI_DOCKERFILE)"; \
+	fi; \
 	if [ ! -f "$$src_dockerfile" ]; then \
 		if [ -f "docker/postgresql/Dockerfile.supabase" ]; then \
 			src_dockerfile="docker/postgresql/Dockerfile.supabase"; \
@@ -253,18 +258,18 @@ postgres-supabase-build:
 			exit 1; \
 		fi; \
 	fi; \
-	sed -e "s|^FROM supabase/postgres:[^ ]*|FROM $(SUPABASE_CLI_IMAGE)|" \
-	    -e "s|^FROM public.ecr.aws/supabase/postgres:[^ ]*|FROM $(SUPABASE_CLI_IMAGE)|" \
+	sed -e "s|^FROM supabase/postgres:[^ ]*|FROM $$supabase_cli_image|" \
+	    -e "s|^FROM public.ecr.aws/supabase/postgres:[^ ]*|FROM $$supabase_cli_image|" \
 		"$$src_dockerfile" > "$$tmp_dockerfile"; \
 	if [ ! -s "$$tmp_dockerfile" ]; then \
 		echo "Error: Generated Dockerfile is empty."; \
 		rm -f "$$tmp_dockerfile"; \
 		exit 1; \
 	fi; \
-	echo "Using base image: $(SUPABASE_CLI_IMAGE)"; \
-	docker build -f "$$tmp_dockerfile" -t "$(SUPABASE_CLI_IMAGE)" .; \
+	echo "Using base image: $$supabase_cli_image"; \
+	docker build --build-arg SUPABASE_POSTGRES_TAG="$(SUPABASE_POSTGRES_TAG)" -f "$$tmp_dockerfile" -t "$$supabase_cli_image" .; \
 	rm -f "$$tmp_dockerfile"; \
-	echo "Build complete: $(SUPABASE_CLI_IMAGE)"
+	echo "Build complete: $$supabase_cli_image"
 
 # Rebuild CloudSync image and restart Supabase CLI stack
 postgres-supabase-rebuild: postgres-supabase-build

docker/README.md

@@ -136,12 +136,17 @@ enabling the extension in the CLI-managed Postgres container.
    make postgres-supabase-build
    ```
    This auto-detects the running `supabase_db` image tag and rebuilds it with
-   CloudSync installed. If you need to override the tag, set
+   CloudSync installed. If you need to override the full image tag, set
    `SUPABASE_CLI_IMAGE=public.ecr.aws/supabase/postgres:<tag>`.
    Example: 
    ```bash
    SUPABASE_CLI_IMAGE=public.ecr.aws/supabase/postgres:17.6.1.071 make postgres-supabase-build
    ```
+   You can also set the Supabase base image tag explicitly (defaults to
+   `17.6.1.071`). This only affects the base image used in the Dockerfile:
+   ```bash
+   SUPABASE_POSTGRES_TAG=17.6.1.071 make postgres-supabase-build
+   ```
 
 4. Restart the stack:
    ```bash
@@ -156,7 +161,10 @@ manually.
 
 Migration-based (notes for CLI): Supabase CLI migrations run as the `postgres`
 role, which cannot create C extensions by default. Use manual enable or grant
-`USAGE` on language `c` once, then migrations will work.
+`USAGE` on language `c` once, then migrations will work. Note: `c` is an
+untrusted language, so `GRANT USAGE ON LANGUAGE c` is only allowed for
+superusers. On the CLI/local stack, the simplest approach is to enable the
+extension manually as `supabase_admin` after `supabase db reset`.
 
 If you still want a migration file, add:
 ```bash

docker/postgresql/Dockerfile.supabase

@@ -1,5 +1,6 @@
 # Build stage for CloudSync extension (match Supabase runtime)
-FROM public.ecr.aws/supabase/postgres:17.6.1.071 AS cloudsync-builder
+ARG SUPABASE_POSTGRES_TAG=17.6.1.071
+FROM public.ecr.aws/supabase/postgres:${SUPABASE_POSTGRES_TAG} AS cloudsync-builder
 
 # Install build dependencies
 RUN apt-get update && apt-get install -y \
@@ -32,7 +33,8 @@ RUN mkdir -p /tmp/cloudsync-artifacts/lib /tmp/cloudsync-artifacts/extension &&
     cp /tmp/cloudsync/docker/postgresql/cloudsync.control /tmp/cloudsync-artifacts/extension/
 
 # Runtime image based on Supabase Postgres
-FROM public.ecr.aws/supabase/postgres:17.6.1.071
+ARG SUPABASE_POSTGRES_TAG=17.6.1.071
+FROM public.ecr.aws/supabase/postgres:${SUPABASE_POSTGRES_TAG}
 
 # Match builder pg_config path
 ENV CLOUDSYNC_PG_CONFIG=/root/.nix-profile/bin/pg_config