[mrrobot47]

Refreshes the postfix image. Postfix 3.8.3 is from November 2023, and its makedefs only knows Linux kernels 3 to 6, so the image no longer builds on kernel 7 hosts ("Unknown system type: Linux 7.0.0-…" in make makefiles). GitHub's runners are still on kernel 6, which is why CI hasn't caught it.

Changes

• Postfix 3.8.3 → 3.11.7, the current stable release. 3.11 is the first line whose makedefs accepts Linux 7; the latest 3.8, 3.9 and 3.10 patch releases still stop at kernel 6. The tarball is fetched over plain HTTP, so it's now checked against a pinned SHA-256 (POSTFIX_VERSION / POSTFIX_SHA256 build args). This also brings in the security fixes released since 3.8.3, such as the SMTP smuggling fix (smtpd_forbid_bare_newline = normalize is the default now).
• smtpd_tls_dh1024_param_file and the dhparam step removed. The setting is deprecated since 3.9 (postconf warns on every call), and DHE is never negotiated with the ECDHE-only cipher list, so TLS behaviour doesn't change.
• /etc/aliases shipped (postmaster: root, built with newaliases). alias_maps defaults to hash:/etc/aliases, but the image had no aliases table, so mail to a local recipient (root@localhost, postmaster@<site>) was deferred with 451 4.3.0 Temporary lookup failure and PHP mail() returned false. The table sits outside /etc/postfix, so sites whose config volume was seeded by an older image get it too when their container is recreated.

postconf -n differs from the current image only in compatibility_level (3.8 → 3.11) and the dropped DH line. Level 3.11 only changes smtp_tls_security_level (already set to may here) and TLSRPT (not built in).

Testing

• Built locally on a kernel 7 host (the current Dockerfile fails there) and on GitHub Actions.
• Fresh container: postconf -h mail_version = 3.11.7, postmap -q postmaster hash:/etc/aliases = root, postconf -n prints no warnings, postfix status running, mail to root@localhost delivered to /var/mail/root, SMTP banner 220 … ESMTP Postfix.
• Existing site: /etc/postfix seeded and configured by easyengine/postfix:v4.13.1 (as EasyEngine does it), then started with this image. PHP mail() through msmtp from a php container returns true for root@localhost and postmaster@site.test and both are delivered (the old image defers them); an external recipient behaves as before. Old volumes keep compatibility_level = 3.8 and the DH line, so postfix logs a deprecation warning and a compatibility notice there; mail delivery is unaffected.

[Copilot]

🔵 Needs a closer look

The multi-release mail-server upgrade needs human confirmation of the reported build and runtime tests, especially compatibility with existing configuration volumes.

No open issues 🎉

What changed in this PR

Updates the Postfix image to support Linux kernel 7 builds and supplies the missing aliases table needed for local mail delivery.

Changes:

• Upgrades Postfix from 3.8.3 to 3.11.7 and adds pinned SHA-256 verification of the downloaded source.
• Removes the deprecated DH parameter setting and generation step.
• Creates /etc/aliases and builds its lookup database outside persisted Postfix configuration volumes.

File	Description
postfix/​Dockerfile	Updates and verifies Postfix sources, removes deprecated TLS configuration, and initializes local aliases.

_{Review effort: Balanced}