apt: optional snapshot pinning (APT_SOURCE=current default, ports.ubuntu.com for arm64; snapshot kept as opt-in)

docker-images/glm53-jovian-r27/Dockerfile

@@ -27,20 +27,39 @@ ARG UV_VERSION
 
 FROM ${CUDA_BASE_IMAGE}@${CUDA_BASE_DIGEST} AS apt-base
 ARG PYPI_INDEX_URL
+ARG APT_SOURCE
 ENV DEBIAN_FRONTEND=noninteractive \
     PIP_BREAK_SYSTEM_PACKAGES=1 \
     UV_SYSTEM_PYTHON=1 UV_BREAK_SYSTEM_PACKAGES=1 UV_LINK_MODE=copy
-COPY locks/apt-sources.list /tmp/apt-sources.list
+COPY locks/apt-sources.list /tmp/apt-sources-snapshot.list
 COPY locks/apt-packages.txt /tmp/apt-packages.txt
 COPY locks/python-bootstrap.txt /tmp/python-bootstrap.txt
-RUN rm -f /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources \
- && cp /tmp/apt-sources.list /etc/apt/sources.list \
- && apt-get update \
- && grep -vE '^\s*(#|$)' /tmp/apt-packages.txt \
-      | xargs apt-get install -y --no-install-recommends \
- && rm -rf /var/lib/apt/lists/* \
- && python3 -m pip install --no-cache-dir --no-deps \
-      -r /tmp/python-bootstrap.txt --index-url ${PYPI_INDEX_URL}
+# APT_SOURCE (versions.env):
+#   snapshot (default, historical behavior): the pinned point-in-time mirror
+#       + exact package versions — strictly reproducible, but
+#       snapshot.ubuntu.com is slow (~30 kB/s) and intermittently 503s
+#       (12-min apt stall, 2026-09-08).
+#   current: the live archive.ubuntu.com — fast and reliable; installs the
+#       pinned package names unversioned. Acceptable: the engine stack is
+#       pinned by the vLLM/B12X/LMCache source pins, not by apt.
+RUN set -eux; \
+    if [ "${APT_SOURCE:-snapshot}" = "current" ]; then \
+        printf '%s\n' \
+            "deb http://ports.ubuntu.com/ubuntu-ports/ noble main restricted universe multiverse" \
+            "deb http://ports.ubuntu.com/ubuntu-ports/ noble-updates main restricted universe multiverse" \
+            "deb http://ports.ubuntu.com/ubuntu-ports/ noble-security main restricted universe multiverse" \
+            > /etc/apt/sources.list; \
+        PKGS="$(grep -vE '^\s*(#|$)' /tmp/apt-packages.txt | cut -d= -f1)"; \
+    else \
+        cp /tmp/apt-sources-snapshot.list /etc/apt/sources.list; \
+        PKGS="$(grep -vE '^\s*(#|$)' /tmp/apt-packages.txt)"; \
+    fi; \
+    rm -f /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ${PKGS}; \
+    rm -rf /var/lib/apt/lists/*; \
+    python3 -m pip install --no-cache-dir --no-deps \
+        -r /tmp/python-bootstrap.txt --index-url "${PYPI_INDEX_URL}"
 
 FROM apt-base AS torch-base
 ARG PYPI_INDEX_URL

docker-images/glm53-jovian-r27/build.sh

@@ -24,7 +24,7 @@ echo "=== Building ${TAG} ==="
 # version-independent stages (apt, torch, CUDA base) are reused across
 # rebuilds — only the pinned source stages (vllm/b12x/…) re-download and
 # re-compile. Override the dir with SM121_BUILDKIT_CACHE if desired.
-CACHE_DIR="${SM121_BUILDKIT_CACHE:-$HOME/sm121-cache/buildkit}"
+CACHE_DIR="${SM121_BUILDKIT_CACHE:-$HOME/.cache/sm121-buildkit}"
 mkdir -p "${CACHE_DIR}"
 docker buildx build "${ARGS[@]}" --cache-from "type=local,src=${CACHE_DIR}" \
     --cache-to "type=local,dest=${CACHE_DIR},mode=max" \

docker-images/glm53-jovian-r27/versions.env

@@ -25,6 +25,14 @@ UV_VERSION=0.11.28
 PYPI_INDEX_URL=https://pypi.org/simple
 PYTORCH_INDEX_URL=https://download.pytorch.org/whl/cu130
 
+# apt mirror for the apt-base stage: current = live ports.ubuntu.com
+# (the canonical arm64 mirror — the CUDA base image's own default; fast and
+# reliable; packages install by pinned name, versions float — the engine
+# stack is pinned by the source pins anyway). snapshot = the pinned
+# point-in-time mirror with exact versions (strictly reproducible, but
+# snapshot.ubuntu.com is slow and 503s: 12-min stall, 2026-09-08).
+APT_SOURCE=current
+
 # DeepGEMM — cloned in-build; pin gated in fetch-deps.sh against the tree's
 # own deepgemm.cmake declaration (same pin in the r27 tree).
 DEEPGEMM_REPO=https://github.com/deepseek-ai/DeepGEMM.git