From 697bc0771026c6abc6f514be23f5702c33ec70db Mon Sep 17 00:00:00 2001 From: Chingis S Date: Sun, 20 Sep 2026 09:58:05 +0400 Subject: [PATCH] Pin base images used by builds Replace timestamp tracking with multi-platform digest inputs consumed by local and CI Makefile targets. Preserve version, variant, and stability-tag selection while passing immutable image references to Docker. Document custom base-image builds and reject selections without a pin. --- .python | 5 ----- Dockerfile | 6 +++++- Makefile | 12 ++++++++---- README.md | 9 +++++++++ base-images.mk | 13 +++++++++++++ 5 files changed, 35 insertions(+), 10 deletions(-) delete mode 100644 .python create mode 100644 base-images.mk diff --git a/.python b/.python deleted file mode 100644 index 356d904..0000000 --- a/.python +++ /dev/null @@ -1,5 +0,0 @@ -3.14.7#2026-09-19T17:09:12.407004Z -3.13.15#2026-09-19T17:08:33.661952Z -3.12.14#2026-09-19T17:07:48.676907Z -3.11.16#2026-09-19T17:07:12.46414Z -3.10.21#2026-09-19T17:06:35.73028Z \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index 867226c..67c585a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,10 @@ +# check=skip=InvalidDefaultArgInFrom + +# The Makefile supplies the required digest-pinned BASE_IMAGE argument. ARG PYTHON_VER -FROM python:${PYTHON_VER}-alpine +ARG BASE_IMAGE +FROM ${BASE_IMAGE} LABEL com.wodby.ci.cache="uv" diff --git a/Makefile b/Makefile index 4afff85..4a4d57f 100644 --- a/Makefile +++ b/Makefile @@ -40,10 +40,14 @@ endif .PHONY: build build-debug buildx-build buildx-push test push shell run start stop logs clean release +# Resolve the same pinned base image for every local and CI build target. +include base-images.mk +BASE_IMAGE_TAG = $(PYTHON_VER)-alpine + default: build build: - docker build -t $(REPO):$(TAG) \ + docker build --build-arg BASE_IMAGE="$(BASE_IMAGE)" -t $(REPO):$(TAG) \ --build-arg PYTHON_VER=$(PYTHON_VER) \ --build-arg PYTHON_DEV=$(PYTHON_DEV) \ --build-arg WODBY_USER_ID=$(WODBY_USER_ID) \ @@ -51,7 +55,7 @@ build: ./ build-debug: - docker build -t $(REPO):$(TAG) \ + docker build --build-arg BASE_IMAGE="$(BASE_IMAGE)" -t $(REPO):$(TAG) \ --build-arg PYTHON_VER=$(PYTHON_VER) \ --build-arg PYTHON_DEV=$(PYTHON_DEV) \ --build-arg WODBY_USER_ID=$(WODBY_USER_ID) \ @@ -60,7 +64,7 @@ build-debug: --no-cache --progress=plain ./ 2>&1 | tee build.log buildx-build: - docker buildx build --platform $(PLATFORM) -t $(REPO):$(TAG) \ + docker buildx build --build-arg BASE_IMAGE="$(BASE_IMAGE)" --platform $(PLATFORM) -t $(REPO):$(TAG) \ --build-arg PYTHON_VER=$(PYTHON_VER) \ --build-arg PYTHON_DEV=$(PYTHON_DEV) \ --build-arg WODBY_USER_ID=$(WODBY_USER_ID) \ @@ -68,7 +72,7 @@ buildx-build: ./ buildx-push: - docker buildx build --platform $(PLATFORM) --push -t $(REPO):$(TAG) \ + docker buildx build --build-arg BASE_IMAGE="$(BASE_IMAGE)" --platform $(PLATFORM) --push -t $(REPO):$(TAG) \ --build-arg PYTHON_VER=$(PYTHON_VER) \ --build-arg PYTHON_DEV=$(PYTHON_DEV) \ --build-arg WODBY_USER_ID=$(WODBY_USER_ID) \ diff --git a/README.md b/README.md index 79e5c3f..f2c1fc9 100644 --- a/README.md +++ b/README.md @@ -156,3 +156,12 @@ commands: files-link public_dir ``` +## Building with pinned base images + +Build with the Makefile to use the base image digests in `base-images.mk`. Local +builds and CI resolve the same version and variant to the same multi-platform +image. A version without a pin fails before the build starts. + +When adding a supported base version or variant, add its image index digest to +`base-images.mk`. For a custom build, override `BASE_IMAGE` with a complete +`repository:tag@sha256:...` reference. diff --git a/base-images.mk b/base-images.mk new file mode 100644 index 0000000..4705e47 --- /dev/null +++ b/base-images.mk @@ -0,0 +1,13 @@ +# Base image inputs shared by local builds and CI. Updated by wodby/images. +# Each digest identifies the complete multi-platform image index. +BASE_IMAGE_REPOSITORY := python +BASE_IMAGE_VERSION_SUFFIX := -alpine + +BASE_IMAGE_DIGEST_3.10.21-alpine := sha256:07a3e27a565ce2397efe9a371c9cd8d675827cb1151fe12ffc7498b447712c56 +BASE_IMAGE_DIGEST_3.11.16-alpine := sha256:0495f5559318affa673172ec7e35cd0a5213e4aaf4c76d0a66554c0af97b157e +BASE_IMAGE_DIGEST_3.12.14-alpine := sha256:c4634f578a412db396771b61b064c6e546c9d6414c7fb5b1b05d5871f1885f7b +BASE_IMAGE_DIGEST_3.13.15-alpine := sha256:1a63a53928ce53d2b0baf08092a703f4840ac5dfbd61fd48802dbf48e08c801e +BASE_IMAGE_DIGEST_3.14.7-alpine := sha256:016508ba505da24f7139765bc4bb669df4e88eb2f12eeadd571bf2f88d7533df + +# Fail before building when a version or variant has no reviewed pin. +BASE_IMAGE = $(BASE_IMAGE_REPOSITORY):$(BASE_IMAGE_TAG)@$(or $(BASE_IMAGE_DIGEST_$(BASE_IMAGE_TAG)),$(error No base image digest for $(BASE_IMAGE_REPOSITORY):$(BASE_IMAGE_TAG); update base-images.mk))