From 5b9b420ffef002956691beb11e4bfbf8ba831fc3 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 10 Jul 2026 05:29:23 +0000 Subject: [PATCH] chore(deps): update container image & action digests --- .github/workflows/stale.yaml | 2 +- .../images/altinity-clickhouse-backup/Dockerfile | 2 +- .../clickhouse/images/clickhouse-backup/Dockerfile | 2 +- packages/apps/http-cache/images/nginx-cache/Dockerfile | 4 ++-- .../kubernetes/images/cluster-autoscaler/Dockerfile | 2 +- .../images/kubevirt-cloud-provider/Dockerfile | 2 +- .../kubernetes/images/kubevirt-csi-driver/Dockerfile | 4 ++-- .../apps/kubernetes/images/talos-csr-signer/Dockerfile | 4 ++-- packages/apps/mariadb/images/mariadb-backup/Dockerfile | 2 +- .../installer/images/cozystack-operator/Dockerfile | 4 ++-- packages/core/platform/images/migrations/Dockerfile | 2 +- packages/core/talos/images/matchbox/Dockerfile | 2 +- packages/core/testing/images/e2e-sandbox/Dockerfile | 2 +- .../images/backup-controller/Dockerfile | 2 +- .../images/backupstrategy-controller/Dockerfile | 2 +- packages/system/bucket/images/s3manager/Dockerfile | 4 ++-- .../Dockerfile | 4 ++-- packages/system/cilium/images/cilium/Dockerfile | 4 ++-- .../cozystack-api/images/cozystack-api/Dockerfile | 2 +- .../images/cozystack-controller/Dockerfile | 2 +- packages/system/dashboard/images/console/Containerfile | 4 ++-- .../system/dashboard/images/token-proxy/Dockerfile | 2 +- .../system/flux-plunger/images/flux-plunger/Dockerfile | 2 +- .../images/flux-shard-operator/Dockerfile | 2 +- .../images/grafana-dashboards/Dockerfile | 2 +- packages/system/kamaji/images/kamaji/Dockerfile | 4 ++-- .../images/keycloak-operator/Dockerfile | 8 ++++---- packages/system/kilo/images/kilo/Dockerfile | 6 +++--- .../kubeovn-plunger/images/kubeovn-plunger/Dockerfile | 2 +- .../kubeovn-webhook/images/kubeovn-webhook/Dockerfile | 4 ++-- .../images/lineage-controller-webhook/Dockerfile | 2 +- .../system/linstor-gui/images/linstor-gui/Dockerfile | 2 +- packages/system/linstor/images/linstor-csi/Dockerfile | 4 ++-- .../system/linstor/images/piraeus-server/Dockerfile | 4 ++-- packages/system/metallb/images/metallb/Dockerfile | 2 +- packages/system/monitoring/images/grafana/Dockerfile | 2 +- packages/system/multus/images/multus-cni/Dockerfile | 4 ++-- .../images/objectstorage/Dockerfile | 10 +++++----- .../redis-operator/images/redis-operator/Dockerfile | 4 ++-- .../images/securitygroup-controller/Dockerfile | 2 +- 40 files changed, 63 insertions(+), 63 deletions(-) diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index 3733e96fc..031a2c904 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -20,7 +20,7 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10 + - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: stale-issue-label: lifecycle/stale stale-pr-label: lifecycle/stale diff --git a/packages/apps/clickhouse/images/altinity-clickhouse-backup/Dockerfile b/packages/apps/clickhouse/images/altinity-clickhouse-backup/Dockerfile index 5de572b46..c2b85d103 100644 --- a/packages/apps/clickhouse/images/altinity-clickhouse-backup/Dockerfile +++ b/packages/apps/clickhouse/images/altinity-clickhouse-backup/Dockerfile @@ -1 +1 @@ -FROM altinity/clickhouse-backup:2.7.2 +FROM altinity/clickhouse-backup:2.7.2@sha256:b8a098dd97d7628bdc33ef6e2cd5798503d8a26984dd5bef844fc19f4d5cf3b0 diff --git a/packages/apps/clickhouse/images/clickhouse-backup/Dockerfile b/packages/apps/clickhouse/images/clickhouse-backup/Dockerfile index 482a16a16..9c4467fb6 100644 --- a/packages/apps/clickhouse/images/clickhouse-backup/Dockerfile +++ b/packages/apps/clickhouse/images/clickhouse-backup/Dockerfile @@ -1,2 +1,2 @@ -FROM clickhouse/clickhouse-server:24.8.4-alpine +FROM clickhouse/clickhouse-server:24.8.4-alpine@sha256:f21e0f9eb18715db90e0b7ca808f36e7418af8126afff1a96163798978adaf17 RUN apk add --no-cache restic uuidgen diff --git a/packages/apps/http-cache/images/nginx-cache/Dockerfile b/packages/apps/http-cache/images/nginx-cache/Dockerfile index 2425acf79..28337ef81 100644 --- a/packages/apps/http-cache/images/nginx-cache/Dockerfile +++ b/packages/apps/http-cache/images/nginx-cache/Dockerfile @@ -1,4 +1,4 @@ -FROM ubuntu:22.04 AS stage +FROM ubuntu:22.04@sha256:0e0a0fc6d18feda9db1590da249ac93e8d5abfea8f4c3c0c849ce512b5ef8982 AS stage ARG NGINX_VERSION=1.25.3 ARG IP2LOCATION_C_VERSION=8.6.1 @@ -162,7 +162,7 @@ RUN checkinstall \ RUN mkdir /packages \ && mv /*/*.deb /packages/ -FROM ubuntu:22.04 +FROM ubuntu:22.04@sha256:0e0a0fc6d18feda9db1590da249ac93e8d5abfea8f4c3c0c849ce512b5ef8982 COPY --from=stage /packages /packages COPY nginx-reloader.sh /usr/bin/nginx-reloader.sh diff --git a/packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile b/packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile index 4a0acd58e..16cf288d0 100644 --- a/packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile +++ b/packages/apps/kubernetes/images/cluster-autoscaler/Dockerfile @@ -1,5 +1,5 @@ # Source: https://raw.githubusercontent.com/kubernetes/autoscaler/refs/heads/master/cluster-autoscaler/Dockerfile.amd64 -ARG builder_image=docker.io/library/golang:1.26 +ARG builder_image=docker.io/library/golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a ARG BASEIMAGE=gcr.io/distroless/static:nonroot-${TARGETARCH} FROM ${builder_image} AS builder diff --git a/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile b/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile index 37e8a9176..7be1fccb5 100644 --- a/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile +++ b/packages/apps/kubernetes/images/kubevirt-cloud-provider/Dockerfile @@ -1,5 +1,5 @@ # Source: https://github.com/kubevirt/cloud-provider-kubevirt/blob/main/build/images/kubevirt-cloud-controller-manager/Dockerfile -FROM golang:1.26 AS builder +FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile b/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile index 5103e415e..73da3b756 100644 --- a/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile +++ b/packages/apps/kubernetes/images/kubevirt-csi-driver/Dockerfile @@ -1,4 +1,4 @@ -ARG builder_image=docker.io/library/golang:1.26 +ARG builder_image=docker.io/library/golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a FROM ${builder_image} AS builder ARG TARGETOS @@ -14,7 +14,7 @@ RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build \ -ldflags "-X kubevirt.io/csi-driver/pkg/service.VendorVersion=0.2.0" \ -o kubevirt-csi-driver . -FROM quay.io/centos/centos:stream9 +FROM quay.io/centos/centos:stream9@sha256:0c9db821f54b244ec5e487056fe782e939db026240f52bc89e1d3a509dca7e8b RUN dnf install -y e2fsprogs xfsprogs nfs-utils && dnf clean all diff --git a/packages/apps/kubernetes/images/talos-csr-signer/Dockerfile b/packages/apps/kubernetes/images/talos-csr-signer/Dockerfile index 7a0dc7001..158a649d0 100644 --- a/packages/apps/kubernetes/images/talos-csr-signer/Dockerfile +++ b/packages/apps/kubernetes/images/talos-csr-signer/Dockerfile @@ -10,7 +10,7 @@ # To bump the upstream version, update COMMIT below to the desired master # SHA and rerun `make image-talos-csr-signer` in packages/apps/kubernetes; # the regenerated images/talos-csr-signer.tag must be committed alongside. -FROM golang:1.26 AS builder +FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder # Upstream is at clastix/talos-csr-signer. Pin to a master SHA so rebuilds # are reproducible; the resulting image digest is what CI fingerprints @@ -27,7 +27,7 @@ RUN curl -sSL "https://github.com/clastix/talos-csr-signer/archive/${COMMIT}.tar RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \ go build -ldflags="-w -s" -o talos-csr-signer . -FROM gcr.io/distroless/static:nonroot +FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478 WORKDIR / COPY --from=builder /workspace/talos-csr-signer /talos-csr-signer USER 65532:65532 diff --git a/packages/apps/mariadb/images/mariadb-backup/Dockerfile b/packages/apps/mariadb/images/mariadb-backup/Dockerfile index 9760302f7..01050faca 100644 --- a/packages/apps/mariadb/images/mariadb-backup/Dockerfile +++ b/packages/apps/mariadb/images/mariadb-backup/Dockerfile @@ -1,2 +1,2 @@ -FROM alpine:3.24 +FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b RUN apk add --no-cache mariadb-client uuidgen restic diff --git a/packages/core/installer/images/cozystack-operator/Dockerfile b/packages/core/installer/images/cozystack-operator/Dockerfile index 5bf401db8..94502f7a0 100644 --- a/packages/core/installer/images/cozystack-operator/Dockerfile +++ b/packages/core/installer/images/cozystack-operator/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder ARG TARGETOS ARG TARGETARCH @@ -17,7 +17,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \ -o /cozystack-operator \ ./cmd/cozystack-operator -FROM alpine:3.24 +FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b COPY --from=builder /cozystack-operator /usr/bin/cozystack-operator diff --git a/packages/core/platform/images/migrations/Dockerfile b/packages/core/platform/images/migrations/Dockerfile index 68f23cc22..9eb0dbfdf 100644 --- a/packages/core/platform/images/migrations/Dockerfile +++ b/packages/core/platform/images/migrations/Dockerfile @@ -5,7 +5,7 @@ # target arch and verify it against the release's cli-SHA256SUMS.txt. Bump # ETCD_OPERATOR_VERSION (and the pinned checksums below) together, keeping it in # sync with packages/system/etcd-operator (Chart appVersion). -FROM alpine:3.24 +FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b ARG TARGETOS ARG TARGETARCH diff --git a/packages/core/talos/images/matchbox/Dockerfile b/packages/core/talos/images/matchbox/Dockerfile index 1db350d73..504afd812 100644 --- a/packages/core/talos/images/matchbox/Dockerfile +++ b/packages/core/talos/images/matchbox/Dockerfile @@ -1,4 +1,4 @@ -FROM quay.io/poseidon/matchbox:v0.11.0 +FROM quay.io/poseidon/matchbox:v0.11.0@sha256:06bcdae85335fd00e8277b007b55cfb49d96a0114628c0f70db2b92b079d246a COPY _out/assets/initramfs-metal-amd64.xz /var/lib/matchbox/assets/initramfs.xz COPY _out/assets/kernel-amd64 /var/lib/matchbox/assets/vmlinuz diff --git a/packages/core/testing/images/e2e-sandbox/Dockerfile b/packages/core/testing/images/e2e-sandbox/Dockerfile index ca7db8e15..bb3b0b148 100644 --- a/packages/core/testing/images/e2e-sandbox/Dockerfile +++ b/packages/core/testing/images/e2e-sandbox/Dockerfile @@ -1,4 +1,4 @@ -FROM ubuntu:24.04 +FROM ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90 ARG KUBECTL_VERSION=1.33.13 ARG TALOSCTL_VERSION=1.13.5 diff --git a/packages/system/backup-controller/images/backup-controller/Dockerfile b/packages/system/backup-controller/images/backup-controller/Dockerfile index 83d7d675f..f146744be 100644 --- a/packages/system/backup-controller/images/backup-controller/Dockerfile +++ b/packages/system/backup-controller/images/backup-controller/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile b/packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile index 243cce651..c54077267 100644 --- a/packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile +++ b/packages/system/backupstrategy-controller/images/backupstrategy-controller/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/bucket/images/s3manager/Dockerfile b/packages/system/bucket/images/s3manager/Dockerfile index e9eb55f07..a0d4f9ee4 100644 --- a/packages/system/bucket/images/s3manager/Dockerfile +++ b/packages/system/bucket/images/s3manager/Dockerfile @@ -1,6 +1,6 @@ # Source: https://github.com/cloudlena/s3manager/blob/main/Dockerfile -FROM docker.io/library/golang:1.26 AS builder +FROM docker.io/library/golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder ARG TARGETOS ARG TARGETARCH @@ -12,7 +12,7 @@ RUN git apply /cozystack.patch RUN go mod tidy RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -ldflags="-s -w" -a -installsuffix cgo -o bin/s3manager -FROM docker.io/library/alpine:3.24 +FROM docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b WORKDIR /usr/src/app RUN addgroup -S s3manager && adduser -S s3manager -G s3manager RUN apk add --no-cache \ diff --git a/packages/system/capi-providers-cpprovider/images/cluster-api-control-plane-provider-kamaji/Dockerfile b/packages/system/capi-providers-cpprovider/images/cluster-api-control-plane-provider-kamaji/Dockerfile index 19768cdd5..fe889d391 100644 --- a/packages/system/capi-providers-cpprovider/images/cluster-api-control-plane-provider-kamaji/Dockerfile +++ b/packages/system/capi-providers-cpprovider/images/cluster-api-control-plane-provider-kamaji/Dockerfile @@ -10,7 +10,7 @@ # which our chart relies on for the talos-trustd sidecar port. Once # upstream ships a real migration path, drop both this Dockerfile and the # patch and consume vanilla upstream images directly. -FROM golang:1.26 AS builder +FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder # Upstream release tag. Bump together with patches/ when refreshing. ARG VERSION=v0.19.0 @@ -28,7 +28,7 @@ RUN git apply --recount /patches/*.diff RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \ go build -a -o manager main.go -FROM gcr.io/distroless/static:nonroot +FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478 WORKDIR / COPY --from=builder /workspace/manager /manager USER 65532:65532 diff --git a/packages/system/cilium/images/cilium/Dockerfile b/packages/system/cilium/images/cilium/Dockerfile index ef3c262bc..55a31bb43 100644 --- a/packages/system/cilium/images/cilium/Dockerfile +++ b/packages/system/cilium/images/cilium/Dockerfile @@ -1,4 +1,4 @@ -ARG VERSION=v1.19.5 +ARG VERSION=v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732 FROM quay.io/cilium/cilium:${VERSION} AS upstream @@ -6,7 +6,7 @@ FROM quay.io/cilium/cilium:${VERSION} AS upstream # throwaway alpine stage and copy the result back over the upstream image. # The agent compiles BPF at startup from /var/lib/cilium/bpf, so replacing # the source file is sufficient. -FROM docker.io/library/alpine:3.22 AS patcher +FROM docker.io/library/alpine:3.22@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce AS patcher RUN apk add --no-cache patch WORKDIR /work COPY --from=upstream /var/lib/cilium/bpf/bpf_host.c ./bpf_host.c diff --git a/packages/system/cozystack-api/images/cozystack-api/Dockerfile b/packages/system/cozystack-api/images/cozystack-api/Dockerfile index 4ad954858..a3605226d 100644 --- a/packages/system/cozystack-api/images/cozystack-api/Dockerfile +++ b/packages/system/cozystack-api/images/cozystack-api/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile b/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile index acba9e016..15596f6b7 100644 --- a/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile +++ b/packages/system/cozystack-controller/images/cozystack-controller/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/dashboard/images/console/Containerfile b/packages/system/dashboard/images/console/Containerfile index 687856ed0..600672f37 100644 --- a/packages/system/dashboard/images/console/Containerfile +++ b/packages/system/dashboard/images/console/Containerfile @@ -1,4 +1,4 @@ -ARG NODE_VERSION=22-alpine +ARG NODE_VERSION=22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2 # Stage 1: Install dependencies and build FROM node:${NODE_VERSION} AS builder @@ -28,7 +28,7 @@ COPY tsconfig.base.json ./ RUN pnpm --filter @cozystack/console build # Stage 2: Serve with nginx -FROM nginxinc/nginx-unprivileged:1.29-alpine +FROM nginxinc/nginx-unprivileged:1.29-alpine@sha256:0c79d56aee561a1d81c63f00eee5fb5fe29279560cdc55e91425133104c7fbe6 COPY --from=builder /src/apps/console/dist /usr/share/nginx/html diff --git a/packages/system/dashboard/images/token-proxy/Dockerfile b/packages/system/dashboard/images/token-proxy/Dockerfile index 81136d3ac..c04ed72fa 100644 --- a/packages/system/dashboard/images/token-proxy/Dockerfile +++ b/packages/system/dashboard/images/token-proxy/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/flux-plunger/images/flux-plunger/Dockerfile b/packages/system/flux-plunger/images/flux-plunger/Dockerfile index 2984840ff..3f159a661 100644 --- a/packages/system/flux-plunger/images/flux-plunger/Dockerfile +++ b/packages/system/flux-plunger/images/flux-plunger/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/flux-shard-operator/images/flux-shard-operator/Dockerfile b/packages/system/flux-shard-operator/images/flux-shard-operator/Dockerfile index 2c44abd71..d7eaec45a 100644 --- a/packages/system/flux-shard-operator/images/flux-shard-operator/Dockerfile +++ b/packages/system/flux-shard-operator/images/flux-shard-operator/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/grafana-operator/images/grafana-dashboards/Dockerfile b/packages/system/grafana-operator/images/grafana-dashboards/Dockerfile index 95afb7b43..288881538 100644 --- a/packages/system/grafana-operator/images/grafana-dashboards/Dockerfile +++ b/packages/system/grafana-operator/images/grafana-dashboards/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.24 +FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b RUN apk add --no-cache darkhttpd diff --git a/packages/system/kamaji/images/kamaji/Dockerfile b/packages/system/kamaji/images/kamaji/Dockerfile index 144c67118..9f3a6a58f 100644 --- a/packages/system/kamaji/images/kamaji/Dockerfile +++ b/packages/system/kamaji/images/kamaji/Dockerfile @@ -1,5 +1,5 @@ # Build the manager binary -FROM golang:1.26 AS builder +FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder ARG VERSION=26.3.6-edge ARG TARGETOS @@ -25,7 +25,7 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build \ # Use distroless as minimal base image to package the manager binary # Refer to https://github.com/GoogleContainerTools/distroless for more details -FROM gcr.io/distroless/static:nonroot +FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478 WORKDIR / COPY --from=builder /workspace/kamaji . USER 65532:65532 diff --git a/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile b/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile index 7a3e2a2a5..59a3623e4 100644 --- a/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile +++ b/packages/system/keycloak-operator/images/keycloak-operator/Dockerfile @@ -1,6 +1,6 @@ -# syntax=docker/dockerfile:1.2 +# syntax=docker/dockerfile:1.2@sha256:e2a8561e419ab1ba6b2fe6cbdf49fd92b95912df1cf7d313c3e2230a333fdbcc -FROM alpine AS source +FROM alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS source ARG COMMIT_REF=facbc36 RUN apk add --no-cache curl tar git WORKDIR /src @@ -11,7 +11,7 @@ RUN curl -sSL https://github.com/epam/edp-keycloak-operator/archive/${COMMIT_REF COPY patches /patches RUN git apply /patches/*.diff -FROM --platform=$BUILDPLATFORM docker.io/golang:1.26 AS builder +FROM --platform=$BUILDPLATFORM docker.io/golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder ARG TARGETOS ARG TARGETARCH @@ -23,7 +23,7 @@ RUN go mod download COPY --from=source /src . RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /build/manager ./cmd -FROM gcr.io/distroless/static:nonroot +FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478 COPY --from=builder /build/manager /manager USER 65532:65532 ENTRYPOINT ["/manager"] diff --git a/packages/system/kilo/images/kilo/Dockerfile b/packages/system/kilo/images/kilo/Dockerfile index b20da859c..815440317 100644 --- a/packages/system/kilo/images/kilo/Dockerfile +++ b/packages/system/kilo/images/kilo/Dockerfile @@ -1,5 +1,5 @@ # Build the kg binary -FROM --platform=$BUILDPLATFORM golang:1.26 AS builder +FROM --platform=$BUILDPLATFORM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder ARG VERSION=944dff5745d747c06555a964c2137b9a986ff6ec ARG TARGETOS @@ -23,14 +23,14 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build \ -a -o kgctl ./cmd/kgctl # Download CNI plugins -FROM alpine:3.24 AS cni +FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS cni ARG TARGETARCH ARG CNI_PLUGINS_VERSION=v1.9.1 RUN apk add --no-cache curl && \ curl -Lo cni.tar.gz https://github.com/containernetworking/plugins/releases/download/$CNI_PLUGINS_VERSION/cni-plugins-linux-$TARGETARCH-$CNI_PLUGINS_VERSION.tgz && \ tar -xf cni.tar.gz -FROM alpine:3.24 +FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b RUN apk add --no-cache ipset iptables ip6tables graphviz font-noto COPY --from=cni bridge host-local loopback portmap /opt/cni/bin/ ADD https://raw.githubusercontent.com/kubernetes-sigs/iptables-wrappers/e139a115350974aac8a82ec4b815d2845f86997e/iptables-wrapper-installer.sh / diff --git a/packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile b/packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile index 7882503f5..aa0a744de 100644 --- a/packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile +++ b/packages/system/kubeovn-plunger/images/kubeovn-plunger/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile b/packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile index e387a3f03..db069842b 100644 --- a/packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile +++ b/packages/system/kubeovn-webhook/images/kubeovn-webhook/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26 AS builder +FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder ARG TARGETOS ARG TARGETARCH @@ -10,7 +10,7 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go mod download COPY . . RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -o webhook . -FROM alpine:3.24 +FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b WORKDIR /app COPY --from=builder /app/webhook /app/webhook diff --git a/packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile b/packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile index 64d46ddbe..c4044400e 100644 --- a/packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile +++ b/packages/system/lineage-controller-webhook/images/lineage-controller-webhook/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder ARG TARGETOS ARG TARGETARCH diff --git a/packages/system/linstor-gui/images/linstor-gui/Dockerfile b/packages/system/linstor-gui/images/linstor-gui/Dockerfile index 2082ef0d4..57a2a1f1e 100644 --- a/packages/system/linstor-gui/images/linstor-gui/Dockerfile +++ b/packages/system/linstor-gui/images/linstor-gui/Dockerfile @@ -2,7 +2,7 @@ # Serves the pre-built LINSTOR GUI tarball published by LINBIT from a hardened # nginx-unprivileged image. nginx.conf is supplied by the chart via ConfigMap, # so the upstream docker-entrypoint.sh / nginx.conf.template is not used. -FROM nginxinc/nginx-unprivileged:1.29-alpine +FROM nginxinc/nginx-unprivileged:1.29-alpine@sha256:0c79d56aee561a1d81c63f00eee5fb5fe29279560cdc55e91425133104c7fbe6 ARG LINSTOR_GUI_VERSION USER root diff --git a/packages/system/linstor/images/linstor-csi/Dockerfile b/packages/system/linstor/images/linstor-csi/Dockerfile index 77d3c6ba1..e216912c1 100644 --- a/packages/system/linstor/images/linstor-csi/Dockerfile +++ b/packages/system/linstor/images/linstor-csi/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26 AS builder +FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder ARG VERSION=v1.11.2 ARG LINSTOR_WAIT_UNTIL_VERSION=v0.3.1 @@ -23,7 +23,7 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 \ RUN curl -fsSL https://github.com/LINBIT/linstor-wait-until/releases/download/$LINSTOR_WAIT_UNTIL_VERSION/linstor-wait-until-$LINSTOR_WAIT_UNTIL_VERSION-$TARGETOS-$TARGETARCH.tar.gz | tar xvzC / -FROM debian:trixie-slim +FROM debian:trixie-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2 RUN apt-get update && apt-get install -y --no-install-recommends \ xfsprogs e2fsprogs nfs-common \ diff --git a/packages/system/linstor/images/piraeus-server/Dockerfile b/packages/system/linstor/images/piraeus-server/Dockerfile index f93e494f8..f63e1ae97 100644 --- a/packages/system/linstor/images/piraeus-server/Dockerfile +++ b/packages/system/linstor/images/piraeus-server/Dockerfile @@ -1,9 +1,9 @@ -ARG DISTRO=bookworm +ARG DISTRO=bookworm@sha256:30482e873082e906a4908c10529180aefb6f77620aea7404b909829fadc5d168 ARG LINSTOR_VERSION # ------------------------------------------------------------------------------ # Build linstor-server from source -FROM debian:bookworm AS builder +FROM debian:bookworm@sha256:30482e873082e906a4908c10529180aefb6f77620aea7404b909829fadc5d168 AS builder ARG LINSTOR_VERSION ARG VERSION=${LINSTOR_VERSION} diff --git a/packages/system/metallb/images/metallb/Dockerfile b/packages/system/metallb/images/metallb/Dockerfile index feaa3b4e5..48c4f2513 100644 --- a/packages/system/metallb/images/metallb/Dockerfile +++ b/packages/system/metallb/images/metallb/Dockerfile @@ -1,4 +1,4 @@ -# syntax=docker/dockerfile:1.2 +# syntax=docker/dockerfile:1.2@sha256:e2a8561e419ab1ba6b2fe6cbdf49fd92b95912df1cf7d313c3e2230a333fdbcc ARG VERSION diff --git a/packages/system/monitoring/images/grafana/Dockerfile b/packages/system/monitoring/images/grafana/Dockerfile index 8f74e9174..5e7a67b9e 100644 --- a/packages/system/monitoring/images/grafana/Dockerfile +++ b/packages/system/monitoring/images/grafana/Dockerfile @@ -1,4 +1,4 @@ -FROM grafana/grafana:11.6.15 +FROM grafana/grafana:11.6.15@sha256:f739273dfed04760428fcfbfccd1752b3b7fc87ef0a3d5637e2e87cce151e1a2 USER root diff --git a/packages/system/multus/images/multus-cni/Dockerfile b/packages/system/multus/images/multus-cni/Dockerfile index 5ee83454e..d2256af28 100644 --- a/packages/system/multus/images/multus-cni/Dockerfile +++ b/packages/system/multus/images/multus-cni/Dockerfile @@ -1,4 +1,4 @@ -FROM --platform=$BUILDPLATFORM golang:1.26 AS build +FROM --platform=$BUILDPLATFORM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS build ARG VERSION=v4.3.0 ARG TARGETPLATFORM @@ -15,7 +15,7 @@ RUN git init && git config user.email "build@cozystack" && git config user.name RUN ./hack/build-go.sh -FROM debian:stable-slim +FROM debian:stable-slim@sha256:ee12ffb55625b99d62837a72f037d9b2f18fd0c787a89c2b9a4f09666c48776c LABEL org.opencontainers.image.source=https://github.com/cozystack/cozystack COPY --from=build /usr/src/multus-cni/bin /usr/src/multus-cni/bin COPY --from=build /usr/src/multus-cni/LICENSE /usr/src/multus-cni/LICENSE diff --git a/packages/system/objectstorage-controller/images/objectstorage/Dockerfile b/packages/system/objectstorage-controller/images/objectstorage/Dockerfile index abaa0c3c9..7fe949527 100644 --- a/packages/system/objectstorage-controller/images/objectstorage/Dockerfile +++ b/packages/system/objectstorage-controller/images/objectstorage/Dockerfile @@ -1,6 +1,6 @@ -# syntax=docker/dockerfile:1.2 +# syntax=docker/dockerfile:1.2@sha256:e2a8561e419ab1ba6b2fe6cbdf49fd92b95912df1cf7d313c3e2230a333fdbcc -FROM alpine AS source +FROM alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS source ARG COMMIT_REF=v0.2.2 RUN apk add --no-cache curl tar git WORKDIR /src @@ -11,7 +11,7 @@ RUN curl -sSL https://github.com/kubernetes-sigs/container-object-storage-interf COPY patches /patches RUN git apply /patches/*.diff -FROM --platform=$BUILDPLATFORM docker.io/golang:1.26 AS builder +FROM --platform=$BUILDPLATFORM docker.io/golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder ARG TARGETOS ARG TARGETARCH @@ -23,12 +23,12 @@ RUN go mod download RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /build/controller ./controller/cmd \ && CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -o /build/sidecar ./sidecar/cmd -FROM gcr.io/distroless/static:nonroot AS controller +FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478 AS controller COPY --from=builder /build/controller /controller USER 65532:65532 ENTRYPOINT ["/controller"] -FROM gcr.io/distroless/static:nonroot AS sidecar +FROM gcr.io/distroless/static:nonroot@sha256:d29e660cc75a5b6b1334e03c5c81ccf9bc0884a002c6000dbf0fb96034814478 AS sidecar COPY --from=builder /build/sidecar /sidecar USER 65532:65532 ENTRYPOINT ["/sidecar"] diff --git a/packages/system/redis-operator/images/redis-operator/Dockerfile b/packages/system/redis-operator/images/redis-operator/Dockerfile index fa1806c33..2886338c4 100644 --- a/packages/system/redis-operator/images/redis-operator/Dockerfile +++ b/packages/system/redis-operator/images/redis-operator/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26 AS builder +FROM golang:1.26@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder ARG VERSION=v1.3.0-rc1 @@ -14,7 +14,7 @@ RUN git apply /patches/*.diff RUN GOOS=$TARGETOS GOARCH=$TARGETARCH VERSION=$VERSION ./scripts/build.sh -FROM alpine:3.24 +FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b RUN apk --no-cache add \ ca-certificates COPY --from=builder /workspace/bin/redis-operator /usr/local/bin diff --git a/packages/system/securitygroup-controller/images/securitygroup-controller/Dockerfile b/packages/system/securitygroup-controller/images/securitygroup-controller/Dockerfile index 5b5b0163c..205d6fb6c 100644 --- a/packages/system/securitygroup-controller/images/securitygroup-controller/Dockerfile +++ b/packages/system/securitygroup-controller/images/securitygroup-controller/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26-alpine AS builder +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS builder ARG TARGETOS ARG TARGETARCH