nebari-dev / nebari-dev/data-science-pack
Pin pixi version in images/Dockerfile
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 5
- Forks
- 7
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 13
Description
images/Dockerfile installs pixi unpinned:
RUN curl -fsSL https://pixi.sh/install.sh | PIXI_HOME=/usr/local bash
PIXI_VERSION appears nowhere in the repo, so every image build takes whatever pixi latest is that day. Not a security issue (pixi install --locked verifies the lock's PyPI sha256 on both cold and warm cache paths), but a pixi minor bump can change lock handling or resolution behavior with no corresponding change in this repo, making builds non-reproducible and failures hard to bisect.
Fix: pass a pinned version to the installer (PIXI_VERSION=vX.Y.Z) via an ARG, and bump it deliberately.
Raised in review of https://github.com/nebari-dev/data-science-pack/pull/241#pullrequestreview-5054401295.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Open images/Dockerfile and inspect the existing pixi installer invocation and image build context. Add a PIXI_VERSION build argument with a deliberate pinned value, then build the image and verify that repeated builds use the same pixi version and continue to honor the lockfile.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- dockerfile
- Domain
- build-system, devops
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 88/100