Engine image build fails: deployments/engine/docker/Dockerfile pins golang:1.25-alpine but go.mod requires go 1.26.8 #12891

What did you do?

Building the Dataflow Engine container image from the repo's own Dockerfile on master fails.

The PingCAP CI task pingcap-build-images builds the engine image with:

kaniko --context . --dockerfile deployments/engine/docker/Dockerfile

which runs make engine inside a golang:1.25-alpine builder.

What did you expect to see?

The engine image (and the tiflow binary) builds successfully, as it did before the go directive was bumped.

What did you see instead?

go.mod on master declares:

go 1.26.8

but the builder stage in deployments/engine/docker/Dockerfile is still:

FROM golang:1.25-alpine as builder

so make engine fails:

CGO_ENABLED=0 GO111MODULE=on go build ... -o bin/tiflow ./cmd/tiflow/main.go
go: go.mod requires go >= 1.26.8 (running go 1.25.14; GOTOOLCHAIN=local)
make: *** [Makefile:559: tiflow] Error 1
error building image: error building stage: failed to execute command: waiting for process to exit: exit status 2

The other two images built in the same task (sync-diff-inspector and dm) just COPY prebuilt binaries, so they are unaffected; only the engine image, which compiles in-image, breaks.

Analysis / root cause

• The go directive in go.mod was bumped from 1.25.14 to 1.26.8 in bump sarama to v1.61.0 and go to v1.26.8 #12873 ("bump sarama to v1.61.0 and go to v1.26.8", merged 2026-09-29), but deployments/engine/docker/Dockerfile was not updated in the same change.
• The engine Dockerfile was last updated in *: upgrade golang to 1.25 #12384 ("upgrade golang to 1.25", 2025-12-11) and still pins golang:1.25-alpine on master today.
• GOTOOLCHAIN=local prevents Go from auto-downloading the 1.26.8 toolchain, so the version mismatch is fatal rather than self-healing.

Suggested fix

Keep the builder image in sync with go.mod, e.g.:

-FROM golang:1.25-alpine as builder
+FROM golang:1.26-alpine as builder

(Alternatively, allow the builder to fetch the required toolchain, but pinning the builder image to match go.mod avoids silent skew.)

Versions of the cluster

Dataflow Engine version (run tiflow version):

master, git sha 1c2d87338af87ad15ed92bad5aa03c24a77efc9a

• go.mod: go 1.26.8
• engine Dockerfile builder: golang:1.25-alpine