mozilla-releng / mozilla-releng/scriptworker-scripts
pin Dockerfile `FROM`s to digests
@gbrownmozilla is already working on this.
Since Oct 1, 2021.
- #422 by @gbrownmozilla — closed without merging
- Dominant language
- Python
- Stars
- 16
- Forks
- 38
- Avg merge
- 1d 7h
- Merged PRs (30d)
- 14
Description
We point our Dockerfiles at docker hub tags, but those tags can move at any point, and we may hit unexpected bustage. Recently, the python:3.8 docker tag moved to an image with an incompatible osslsigncode, which busted signingscript.
Ben suggested we pin our Dockerfiles to digests and explicitly bump them. Renovatebot can bump these (though we may have to do so manually if we specify the digest in an env var). This way we can explicitly decide when to roll out a new base image, after we've tested it for bustage.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.