cc @alexey-milovidov @Algunenano — could you review this? It ports the wget_with_retry wrapper from Dockerfile.alpine (which @alexey-milovidov added in #100380) to Dockerfile.ubuntu and Dockerfile.distroless, so a transient 500/503 from clickhouse-builds.s3.amazonaws.com no longer kills the Docker server image build on the first try. Triggered by @alexey-milovidov's directive on #100173.

Pre-PR validation gate (per worker policy):

This is an infrastructure / Dockerfile fix, not a flaky-test fix, so the deterministic-repro gate doesn't apply 1:1. The relevant checks:

• a) Deterministic repro? Not on-demand reproducible (the trigger is an external S3 outage), but the failure shape is reproduced 3× across 3 unrelated PRs in 3 days (Add user_files_policy server setting for custom disks in user_files directory #100173 / 500, Wire functions stress test to ProcessList for KILL-QUERY-style timeouts #104694 / 503, Fix block structure mismatch in UnionStep after filter push-down with NULL constants #104853 / 503) — concrete signal, not anecdote.
• b) Root cause explained? Yes. Dockerfile.ubuntu and Dockerfile.distroless run wget ... || exit 1 once. A single 5xx from clickhouse-builds.s3.amazonaws.com then fails the whole docker build step. Dockerfile.alpine already wraps wget with wget_with_retry (added in Add wget retry logic to Alpine Docker image build #100380); Ubuntu/distroless were just never updated.
• c) Fix matches root cause? Yes — adds the same wget_with_retry wrapper around the DIRECT_DOWNLOAD_URLS wget call in both Dockerfiles. Same approach @alexey-milovidov used for Alpine in Add wget retry logic to Alpine Docker image build #100380.
• d) Test intent preserved? No tests changed. Build behaviour on success is unchanged (wrapper succeeds on first attempt → same as before). On transient failure, wrapper retries up to WGET_RETRIES=5 times (overridable) instead of failing immediately.
• e) Both directions demonstrated? Shell function syntax checked under sh/bash/dash (all parse clean). Retry behaviour validated locally against an unreachable URL — confirmed it retries WGET_RETRIES times with WGET_RETRY_DELAY between attempts, then exits non-zero.
• f) Fix is general? Yes — wrapper is applied in both Ubuntu and distroless Dockerfiles in one go. Alpine already has it. The deb_location_url/single_binary_location_url blocks are untouched because CI doesn't take those paths (DIRECT_DOWNLOAD_URLS is what fails). Happy to extend the wrapper to those blocks too if you'd prefer one consistent style across all install paths.

Cross-PR check at PR-creation time: no competing open PR touching Dockerfile.ubuntu/Dockerfile.distroless or mentioning wget_with_retry/DIRECT_DOWNLOAD_URLS.

Workflow [PR], commit [394cd58]

Summary: ✅

AI Review

Summary

This PR adds wget_with_retry to docker/server/Dockerfile.ubuntu and docker/server/Dockerfile.distroless for the DIRECT_DOWNLOAD_URLS install path, aligning behavior with the existing Alpine retry approach so transient S3 500/503 responses do not fail the image build on the first attempt. I reviewed the current diff and prior discussion, and I did not find unresolved correctness, safety, or contract violations in the changed code.

Final Verdict

• Status: ✅ Approve