Pin the base image by digest and drop the inert `yum update -y`
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 35/100
- Issue type
- Refactor
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- docker, dockerfile
- Domain
- build-system, devops
Research direction
Read the top of Dockerfile and compare the base-image decision with Dependabot work in #2185. Confirm the dated Amazon Linux image and its digest strategy, remove the inert update line, and ensure the final FROM line preserves a readable tag with a digest.
Written by the indexing model from the issue text.
Description
Two changes to the top of Dockerfile, both one line. They can land separately.
The yum update -y cannot install anything. An Amazon Linux 2023 dated tag pins dnf's $releasever to the snapshot date, which I confirmed by reading it inside both images:
| Tag | $releasever |
|---|---|
2023.12.20260909.0 |
2023.12.20260909 |
2023.12.20260914.0 |
2023.12.20260914 |
The repo config resolves through mirrorlist=https://cdn.amazonlinux.com/al2023/core/mirrors/$releasever/$basearch/mirror.list, a frozen dated mirror. Running the update inside the older pinned base reports Nothing to do and leaves every package exactly where it was. #2183 added a comment saying so, but a line that can never do anything is better deleted than annotated. dnf upgrade --releasever=latest would genuinely pull packages forward, and I do not want it, because it destroys the reproducibility the pin exists for.
The tag has no digest. A registry tag is a mutable pointer, so the "reproducible builds" claim in the comment above FROM is a convention we trust rather than something the build checks. Adding @sha256:<digest> alongside the readable tag makes the claim true and keeps bumps reviewable.
Decide the digest question together with the Dependabot work in #2185, since Dependabot's docker updater can maintain a tag@digest pair and that changes how much the pin costs us.
[!IMPORTANT]
Internal only — this issue is maintained by the core team and is not accepting external contributions.
- Dominant language
- TypeScript
- Stars
- 481
- Forks
- 110
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 9
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from aws/graph-explorer
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
aws/graph-explorer#2199 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
aws/graph-explorer#2196 · 2 comments ·
-
help wanted needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
aws/graph-explorer#2060 ·
-
help wanted reliability usability
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
aws/graph-explorer#1977 · 2 comments ·
-
documentation usability
Difficulty 2/5 1-2 days Newbie friendliness 68/100
aws/graph-explorer#1719 ·
All issues in aws/graph-explorer
Similar issues
-
comp/dashboard P3 type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
NousResearch/hermes-agent#117722 ·
-
clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro impact:ux-friction issue-rating: 🦞 diamond lobster no-stale P3
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 76/100
-
code-quality refactoring
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
github/gh-aw-firewall#8816 ·
-
integration:quickjs org:external priority:backlog topic:code-interpreter topic:middleware type:feature
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
langchain-ai/deepagents#6450 ·