From 9b5cc37ad4e2632b62f08cc30eef5a589bb21d8d Mon Sep 17 00:00:00 2001 From: Tyler Koenig Date: Mon, 1 Jun 2026 21:38:31 -0400 Subject: [PATCH] build(docker): pin base images by digest Prevents silently pulling a compromised or broken upstream image. Digests must be updated manually when bumping Alpine/Go versions. --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index f488e09..5544ce8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # --- Stage 1: Builder --- -FROM golang:1.26-alpine3.23 AS builder +FROM golang:1.26-alpine3.23@sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d AS builder RUN apk add --no-cache gcc musl-dev WORKDIR /app COPY go.mod go.sum ./ @@ -15,7 +15,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \ go build -trimpath -ldflags="-s -w -X main.version=${VERSION} -X main.commit=${COMMIT} -X main.date=${BUILD_DATE}" -o uptop ./cmd/uptop/main.go # --- Stage 2: Runner --- -FROM alpine:3.23 +FROM alpine:3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 WORKDIR /app RUN apk add --no-cache ca-certificates && apk upgrade --no-cache RUN addgroup -g 1000 -S uptop && adduser -u 1000 -S uptop -G uptop