Fix: update EOL base images and broken configs in four community builders

[64johnlee]

Summary

Fixes four community builders that use end-of-life base images or have broken configurations that prevent them from working correctly.

---

jsonnet — ubuntu:xenial EOL (Apr 2021)

File: jsonnet/Dockerfile

• ubuntu:xenial reached EOL on April 30, 2021. It no longer receives security patches.
• Updated to ubuntu:22.04 LTS (supported until April 2027).
• Added --no-install-recommends and cache cleanup to reduce image size.

---

earthly — ubuntu:bionic EOL (Apr 2023) + stale version

File: earthly/Dockerfile

• ubuntu:bionic reached EOL on April 2, 2023.
• Updated to ubuntu:22.04 LTS.
• Default version 0.5.23 → 0.8.0 (0.5.x is two major versions behind; 0.8.x is current stable).

---

protoc — debian:buster-slim EOL (Sep 2024) + stale version

File: protoc/Dockerfile

• debian:buster-slim reached EOL on September 10, 2024.
• Updated to debian:bookworm-slim (current Debian stable, supported until 2028).
• Default protobuf version 3.12.4 → 27.3 (current stable; protobuf adopted sequential versioning after v3.21).

---

dataflow-python3 — three bugs fixed

File: dataflow-python3/Dockerfile

1. Python 3.7 EOL (Jun 2023) → Python 3.12
Python 3.7 no longer receives security updates. Python 3.12 is LTS through October 2028.

2. Broken ENTRYPOINT format

# Before (broken — shell form, no exec, no signal handling)
ENTRYPOINT bin/bash

# After (correct exec form)
ENTRYPOINT [/bin/bash]

3. No-op virtualenv activation (3 broken RUN layers)
Each Docker RUN executes in a fresh shell; source venv/bin/activate has no effect on subsequent RUN commands. The pip install was going to the system Python, not the virtualenv. Also, ENTRYPOINT was placed between RUN commands which is invalid.

# Before (broken)
RUN virtualenv venv
ENTRYPOINT bin/bash                          # misplaced
RUN /bin/bash -c "source venv/bin/activate" # no-op
RUN pip install apache-beam[gcp]             # installs to system Python, not venv

# After (correct)
RUN pip install --no-cache-dir apache-beam[gcp]
ENTRYPOINT ["/bin/bash"]

🤖 Generated with Claude Code

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.