chore(deps): update container image & action digests (#3232)

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/stale](https://redirect.github.com/actions/stale) ([changelog](https://redirect.github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899..1e223db275d687790206a7acac4d1a11bd6fe629)) | action | digest | `eb5cf3a` → `1e223db` | | alpine | final | pinDigest | → `28bd5fe` | | alpine | stage | pinDigest | → `28bd5fe` | | [altinity/clickhouse-backup](https://redirect.github.com/Altinity/clickhouse-backup) | final | pinDigest | → `b8a098d` | | clickhouse/clickhouse-server | final | pinDigest | → `f21e0f9` | | debian | final | pinDigest | → `ee12ffb` | | debian | final | pinDigest | → `30482e8` | | debian | stage | pinDigest | → `30482e8` | | debian | final | pinDigest | → `28de087` | | docker.io/golang | stage | pinDigest | → `079e598` | | docker.io/library/alpine | final | pinDigest | → `1435830` | | docker.io/library/alpine | final | pinDigest | → `28bd5fe` | | docker.io/library/golang | stage | pinDigest | → `079e598` | | [docker/dockerfile](https://redirect.github.com/moby/buildkit) | syntax | pinDigest | → `e2a8561` | | gcr.io/distroless/static | final | pinDigest | → `d29e660` | | gcr.io/distroless/static | stage | pinDigest | → `d29e660` | | golang | final | pinDigest | → `0178a64` | | golang | stage | pinDigest | → `079e598` | | golang | stage | pinDigest | → `0178a64` | | golang | final | pinDigest | → `079e598` | | [grafana/grafana](https://redirect.github.com/grafana/grafana) | final | pinDigest | → `f739273` | | [nginxinc/nginx-unprivileged](https://redirect.github.com/nginx/docker-nginx-unprivileged) | final | pinDigest | → `0c79d56` | | [node](https://redirect.github.com/nodejs/node) | stage | pinDigest | → `16e22a5` | | quay.io/centos/centos | final | pinDigest | → `0c9db82` | | quay.io/cilium/cilium | stage | pinDigest | → `20fbbc1` | | [quay.io/poseidon/matchbox](https://redirect.github.com/poseidon/matchbox) | final | pinDigest | → `06bcdae` | | ubuntu | final | pinDigest | → `4fbb8e6` | | ubuntu | final | pinDigest | → `0e0a0fc` | | ubuntu | stage | pinDigest | → `0e0a0fc` | --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/cozystack/cozystack).
2026-11-07 04:23:50 +09:00 · 2026-07-10 12:22:35 +05:00
commit c8ee5dc317
@@ -20,7 +20,7 @@ jobs:
      issues: write
      pull-requests: write
    steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10
        with:
          stale-issue-label: lifecycle/stale
          stale-pr-label: lifecycle/stale
@@ -1 +1 @@
-FROM altinity/clickhouse-backup:2.7.2
+FROM altinity/clickhouse-backup:2.7.2@sha256:b8a098dd97d7628bdc33ef6e2cd5798503d8a26984dd5bef844fc19f4d5cf3b0
@@ -1,2 +1,2 @@
-FROM clickhouse/clickhouse-server:24.8.4-alpine
+FROM clickhouse/clickhouse-server:24.8.4-alpine@sha256:f21e0f9eb18715db90e0b7ca808f36e7418af8126afff1a96163798978adaf17
 RUN apk add --no-cache restic uuidgen
@@ -1,4 +1,4 @@
-FROM ubuntu:22.04 AS stage
+FROM ubuntu:22.04@sha256:0e0a0fc6d18feda9db1590da249ac93e8d5abfea8f4c3c0c849ce512b5ef8982 AS stage

 ARG NGINX_VERSION=1.25.3
 ARG IP2LOCATION_C_VERSION=8.6.1
@@ -162,7 +162,7 @@ RUN checkinstall \
 RUN mkdir /packages \
 && mv /*/*.deb /packages/

-FROM ubuntu:22.04
+FROM ubuntu:22.04@sha256:0e0a0fc6d18feda9db1590da249ac93e8d5abfea8f4c3c0c849ce512b5ef8982
 COPY --from=stage /packages /packages
 COPY nginx-reloader.sh /usr/bin/nginx-reloader.sh

@@ -1,5 +1,5 @@
 # Source: https://raw.githubusercontent.com/kubernetes/autoscaler/refs/heads/master/cluster-autoscaler/Dockerfile.amd64
-ARG builder_image=docker.io/library/golang:1.26
+ARG builder_image=docker.io/library/golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a
 ARG BASEIMAGE=gcr.io/distroless/static:nonroot-${TARGETARCH}

 FROM ${builder_image} AS builder
@@ -1,5 +1,5 @@
 # Source: https://github.com/kubevirt/cloud-provider-kubevirt/blob/main/build/images/kubevirt-cloud-controller-manager/Dockerfile
-FROM golang:1.26 AS builder
+FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,4 +1,4 @@
-ARG builder_image=docker.io/library/golang:1.26
+ARG builder_image=docker.io/library/golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a
 FROM ${builder_image} AS builder

 ARG TARGETOS
@@ -14,7 +14,7 @@ RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build \
    -ldflags "-X kubevirt.io/csi-driver/pkg/service.VendorVersion=0.2.0" \
    -o kubevirt-csi-driver .

-FROM quay.io/centos/centos:stream9
+FROM quay.io/centos/centos:stream9@sha256:0c9db821f54b244ec5e487056fe782e939db026240f52bc89e1d3a509dca7e8b

 RUN dnf install -y e2fsprogs xfsprogs nfs-utils && dnf clean all

@@ -10,7 +10,7 @@
 # To bump the upstream version, update COMMIT below to the desired master
 # SHA and rerun `make image-talos-csr-signer` in packages/apps/kubernetes;
 # the regenerated images/talos-csr-signer.tag must be committed alongside.
-FROM golang:1.26 AS builder
+FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder

 # Upstream is at clastix/talos-csr-signer. Pin to a master SHA so rebuilds
 # are reproducible; the resulting image digest is what CI fingerprints
@@ -27,7 +27,7 @@ RUN curl -sSL "https://github.com/clastix/talos-csr-signer/archive/${COMMIT}.tar
 RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
    go build -ldflags="-w -s" -o talos-csr-signer .

-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478
 WORKDIR /
 COPY --from=builder /workspace/talos-csr-signer /talos-csr-signer
 USER 65532:65532
@@ -1,2 +1,2 @@
-FROM alpine:3.24
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 RUN apk add --no-cache mariadb-client uuidgen restic
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -17,7 +17,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
  -o /cozystack-operator \
  ./cmd/cozystack-operator

-FROM alpine:3.24
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b

 COPY --from=builder /cozystack-operator /usr/bin/cozystack-operator

@@ -5,7 +5,7 @@
 # target arch and verify it against the release's cli-SHA256SUMS.txt. Bump
 # ETCD_OPERATOR_VERSION (and the pinned checksums below) together, keeping it in
 # sync with packages/system/etcd-operator (Chart appVersion).
-FROM alpine:3.24
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,4 +1,4 @@
-FROM quay.io/poseidon/matchbox:v0.11.0
+FROM quay.io/poseidon/matchbox:v0.11.0@sha256:06bcdae85335fd00e8277b007b55cfb49d96a0114628c0f70db2b92b079d246a

 COPY _out/assets/initramfs-metal-amd64.xz /var/lib/matchbox/assets/initramfs.xz
 COPY _out/assets/kernel-amd64 /var/lib/matchbox/assets/vmlinuz
@@ -1,4 +1,4 @@
-FROM ubuntu:24.04
+FROM ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90

 ARG KUBECTL_VERSION=1.33.13
 ARG TALOSCTL_VERSION=1.13.5
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,6 +1,6 @@
 # Source: https://github.com/cloudlena/s3manager/blob/main/Dockerfile

-FROM docker.io/library/golang:1.26 AS builder
+FROM docker.io/library/golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -12,7 +12,7 @@ RUN git apply /cozystack.patch
 RUN go mod tidy
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -ldflags="-s -w" -a -installsuffix cgo -o bin/s3manager

-FROM docker.io/library/alpine:3.24
+FROM docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 WORKDIR /usr/src/app
 RUN addgroup -S s3manager && adduser -S s3manager -G s3manager
 RUN apk add --no-cache \
@@ -10,7 +10,7 @@
 # which our chart relies on for the talos-trustd sidecar port. Once
 # upstream ships a real migration path, drop both this Dockerfile and the
 # patch and consume vanilla upstream images directly.
-FROM golang:1.26 AS builder
+FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder

 # Upstream release tag. Bump together with patches/ when refreshing.
 ARG VERSION=v0.19.0
@@ -28,7 +28,7 @@ RUN git apply --recount /patches/*.diff
 RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
    go build -a -o manager main.go

-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478
 WORKDIR /
 COPY --from=builder /workspace/manager /manager
 USER 65532:65532
@@ -1,4 +1,4 @@
-ARG VERSION=v1.19.5
+ARG VERSION=v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732

 FROM quay.io/cilium/cilium:${VERSION} AS upstream

@@ -6,7 +6,7 @@ FROM quay.io/cilium/cilium:${VERSION} AS upstream
 # throwaway alpine stage and copy the result back over the upstream image.
 # The agent compiles BPF at startup from /var/lib/cilium/bpf, so replacing
 # the source file is sufficient.
-FROM docker.io/library/alpine:3.22 AS patcher
+FROM docker.io/library/alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce AS patcher
 RUN apk add --no-cache patch
 WORKDIR /work
 COPY --from=upstream /var/lib/cilium/bpf/bpf_host.c ./bpf_host.c
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,4 +1,4 @@
-ARG NODE_VERSION=22-alpine
+ARG NODE_VERSION=22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2

 # Stage 1: Install dependencies and build
 FROM node:${NODE_VERSION} AS builder
@@ -28,7 +28,7 @@ COPY tsconfig.base.json ./
 RUN pnpm --filter @cozystack/console build

 # Stage 2: Serve with nginx
-FROM nginxinc/nginx-unprivileged:1.29-alpine
+FROM nginxinc/nginx-unprivileged:1.29-alpine@sha256:0c79d56aee561a1d81c63f00eee5fb5fe29279560cdc55e91425133104c7fbe6

 COPY --from=builder /src/apps/console/dist /usr/share/nginx/html

@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,4 +1,4 @@
-FROM alpine:3.24
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b

 RUN apk add --no-cache darkhttpd

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.26 AS builder
+FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder

 ARG VERSION=26.3.6-edge
 ARG TARGETOS
@@ -25,7 +25,7 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build \

 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478
 WORKDIR /
 COPY --from=builder /workspace/kamaji .
 USER 65532:65532
@@ -1,6 +1,6 @@
-# syntax=docker/dockerfile:1.2
+# syntax=docker/dockerfile:1.2@sha256:e2a8561e419ab1ba6b2fe6cbdf49fd92b95912df1cf7d313c3e2230a333fdbcc

-FROM alpine AS source
+FROM alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS source
 ARG COMMIT_REF=facbc36
 RUN apk add --no-cache curl tar git
 WORKDIR /src
@@ -11,7 +11,7 @@ RUN curl -sSL https://github.com/epam/edp-keycloak-operator/archive/${COMMIT_REF
 COPY patches /patches
 RUN git apply /patches/*.diff

-FROM --platform=$BUILDPLATFORM docker.io/golang:1.26 AS builder
+FROM --platform=$BUILDPLATFORM docker.io/golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder
 ARG TARGETOS
 ARG TARGETARCH

@@ -23,7 +23,7 @@ RUN go mod download
 COPY --from=source /src .
 RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /build/manager ./cmd

-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478
 COPY --from=builder /build/manager /manager
 USER 65532:65532
 ENTRYPOINT ["/manager"]
@@ -1,5 +1,5 @@
 # Build the kg binary
-FROM --platform=$BUILDPLATFORM golang:1.26 AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder

 ARG VERSION=944dff5745d747c06555a964c2137b9a986ff6ec
 ARG TARGETOS
@@ -23,14 +23,14 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build \
    -a -o kgctl ./cmd/kgctl

 # Download CNI plugins
-FROM alpine:3.24 AS cni
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS cni
 ARG TARGETARCH
 ARG CNI_PLUGINS_VERSION=v1.9.1
 RUN apk add --no-cache curl && \
    curl -Lo cni.tar.gz https://github.com/containernetworking/plugins/releases/download/$CNI_PLUGINS_VERSION/cni-plugins-linux-$TARGETARCH-$CNI_PLUGINS_VERSION.tgz && \
    tar -xf cni.tar.gz

-FROM alpine:3.24
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 RUN apk add --no-cache ipset iptables ip6tables graphviz font-noto
 COPY --from=cni bridge host-local loopback portmap /opt/cni/bin/
 ADD https://raw.githubusercontent.com/kubernetes-sigs/iptables-wrappers/e139a115350974aac8a82ec4b815d2845f86997e/iptables-wrapper-installer.sh /
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,4 +1,4 @@
-FROM golang:1.26 AS builder
+FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -10,7 +10,7 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go mod download
 COPY . .
 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o webhook .

-FROM alpine:3.24
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 WORKDIR /app

 COPY --from=builder /app/webhook /app/webhook
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder

 ARG TARGETOS
 ARG TARGETARCH
@@ -2,7 +2,7 @@
 # Serves the pre-built LINSTOR GUI tarball published by LINBIT from a hardened
 # nginx-unprivileged image. nginx.conf is supplied by the chart via ConfigMap,
 # so the upstream docker-entrypoint.sh / nginx.conf.template is not used.
-FROM nginxinc/nginx-unprivileged:1.29-alpine
+FROM nginxinc/nginx-unprivileged:1.29-alpine@sha256:0c79d56aee561a1d81c63f00eee5fb5fe29279560cdc55e91425133104c7fbe6

 ARG LINSTOR_GUI_VERSION
 USER root
@@ -1,4 +1,4 @@
-FROM golang:1.26 AS builder
+FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder

 ARG VERSION=v1.11.2
 ARG LINSTOR_WAIT_UNTIL_VERSION=v0.3.1
@@ -23,7 +23,7 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 \

 RUN curl -fsSL https://github.com/LINBIT/linstor-wait-until/releases/download/$LINSTOR_WAIT_UNTIL_VERSION/linstor-wait-until-$LINSTOR_WAIT_UNTIL_VERSION-$TARGETOS-$TARGETARCH.tar.gz | tar xvzC /

-FROM debian:trixie-slim
+FROM debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2

 RUN apt-get update && apt-get install -y --no-install-recommends \
      xfsprogs e2fsprogs nfs-common \
@@ -1,9 +1,9 @@
-ARG DISTRO=bookworm
+ARG DISTRO=bookworm@sha256:30482e873082e906a4908c10529180aefb6f77620aea7404b909829fadc5d168
 ARG LINSTOR_VERSION

 # ------------------------------------------------------------------------------
 # Build linstor-server from source
-FROM debian:bookworm AS builder
+FROM debian:bookworm@sha256:30482e873082e906a4908c10529180aefb6f77620aea7404b909829fadc5d168 AS builder

 ARG LINSTOR_VERSION
 ARG VERSION=${LINSTOR_VERSION}
@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.2
+# syntax=docker/dockerfile:1.2@sha256:e2a8561e419ab1ba6b2fe6cbdf49fd92b95912df1cf7d313c3e2230a333fdbcc

 ARG VERSION

@@ -1,4 +1,4 @@
-FROM grafana/grafana:11.6.15
+FROM grafana/grafana:11.6.15@sha256:f739273dfed04760428fcfbfccd1752b3b7fc87ef0a3d5637e2e87cce151e1a2

 USER root

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1.26 AS build
+FROM --platform=$BUILDPLATFORM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS build

 ARG VERSION=v4.3.0
 ARG TARGETPLATFORM
@@ -15,7 +15,7 @@ RUN git init && git config user.email "build@cozystack" && git config user.name

 RUN ./hack/build-go.sh

-FROM debian:stable-slim
+FROM debian:stable-slim@sha256:ee12ffb55625b99d62837a72f037d9b2f18fd0c787a89c2b9a4f09666c48776c
 LABEL org.opencontainers.image.source=https://github.com/cozystack/cozystack
 COPY --from=build /usr/src/multus-cni/bin /usr/src/multus-cni/bin
 COPY --from=build /usr/src/multus-cni/LICENSE /usr/src/multus-cni/LICENSE
@@ -1,6 +1,6 @@
-# syntax=docker/dockerfile:1.2
+# syntax=docker/dockerfile:1.2@sha256:e2a8561e419ab1ba6b2fe6cbdf49fd92b95912df1cf7d313c3e2230a333fdbcc

-FROM alpine AS source
+FROM alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS source
 ARG COMMIT_REF=v0.2.2
 RUN apk add --no-cache curl tar git
 WORKDIR /src
@@ -11,7 +11,7 @@ RUN curl -sSL https://github.com/kubernetes-sigs/container-object-storage-interf
 COPY patches /patches
 RUN git apply /patches/*.diff

-FROM --platform=$BUILDPLATFORM docker.io/golang:1.26 AS builder
+FROM --platform=$BUILDPLATFORM docker.io/golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder
 ARG TARGETOS
 ARG TARGETARCH

@@ -23,12 +23,12 @@ RUN go mod download
 RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /build/controller ./controller/cmd \
 && CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /build/sidecar ./sidecar/cmd

-FROM gcr.io/distroless/static:nonroot AS controller
+FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478 AS controller
 COPY --from=builder /build/controller /controller
 USER 65532:65532
 ENTRYPOINT ["/controller"]

-FROM gcr.io/distroless/static:nonroot AS sidecar
+FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478 AS sidecar
 COPY --from=builder /build/sidecar /sidecar
 USER 65532:65532
 ENTRYPOINT ["/sidecar"]
@@ -1,4 +1,4 @@
-FROM golang:1.26 AS builder
+FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder

 ARG VERSION=v1.3.0-rc1

@@ -14,7 +14,7 @@ RUN git apply /patches/*.diff

 RUN GOOS=$TARGETOS GOARCH=$TARGETARCH VERSION=$VERSION ./scripts/build.sh

-FROM alpine:3.24
+FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 RUN apk --no-cache add \
  ca-certificates
 COPY --from=builder /workspace/bin/redis-operator /usr/local/bin
@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine AS builder
+FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder

 ARG TARGETOS
 ARG TARGETARCH