Skip to content

Build from pinned base image digests #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
csandanov merged 1 commit into from
Sep 20, 2026
Merged

Build from pinned base image digests #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions .python
View file
Open in desktop

This file was deleted.

6 changes: 5 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@
# check=skip=InvalidDefaultArgInFrom

# The Makefile supplies the required digest-pinned BASE_IMAGE argument.
ARG PYTHON_VER

FROM python:${PYTHON_VER}-alpine
ARG BASE_IMAGE
FROM ${BASE_IMAGE}

LABEL com.wodby.ci.cache="uv"

Expand Down
12 changes: 8 additions & 4 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,18 +40,22 @@ endif

.PHONY: build build-debug buildx-build buildx-push test push shell run start stop logs clean release

# Resolve the same pinned base image for every local and CI build target.
include base-images.mk
BASE_IMAGE_TAG = $(PYTHON_VER)-alpine

default: build

build:
docker build -t $(REPO):$(TAG) \
docker build --build-arg BASE_IMAGE="$(BASE_IMAGE)" -t $(REPO):$(TAG) \
--build-arg PYTHON_VER=$(PYTHON_VER) \
--build-arg PYTHON_DEV=$(PYTHON_DEV) \
--build-arg WODBY_USER_ID=$(WODBY_USER_ID) \
--build-arg WODBY_GROUP_ID=$(WODBY_GROUP_ID) \
./

build-debug:
docker build -t $(REPO):$(TAG) \
docker build --build-arg BASE_IMAGE="$(BASE_IMAGE)" -t $(REPO):$(TAG) \
--build-arg PYTHON_VER=$(PYTHON_VER) \
--build-arg PYTHON_DEV=$(PYTHON_DEV) \
--build-arg WODBY_USER_ID=$(WODBY_USER_ID) \
Expand All @@ -60,15 +64,15 @@ build-debug:
--no-cache --progress=plain ./ 2>&1 | tee build.log

buildx-build:
docker buildx build --platform $(PLATFORM) -t $(REPO):$(TAG) \
docker buildx build --build-arg BASE_IMAGE="$(BASE_IMAGE)" --platform $(PLATFORM) -t $(REPO):$(TAG) \
--build-arg PYTHON_VER=$(PYTHON_VER) \
--build-arg PYTHON_DEV=$(PYTHON_DEV) \
--build-arg WODBY_USER_ID=$(WODBY_USER_ID) \
--build-arg WODBY_GROUP_ID=$(WODBY_GROUP_ID) \
./

buildx-push:
docker buildx build --platform $(PLATFORM) --push -t $(REPO):$(TAG) \
docker buildx build --build-arg BASE_IMAGE="$(BASE_IMAGE)" --platform $(PLATFORM) --push -t $(REPO):$(TAG) \
--build-arg PYTHON_VER=$(PYTHON_VER) \
--build-arg PYTHON_DEV=$(PYTHON_DEV) \
--build-arg WODBY_USER_ID=$(WODBY_USER_ID) \
Expand Down
9 changes: 9 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,3 +156,12 @@ commands:
files-link public_dir
```

## Building with pinned base images

Build with the Makefile to use the base image digests in `base-images.mk`. Local
builds and CI resolve the same version and variant to the same multi-platform
image. A version without a pin fails before the build starts.

When adding a supported base version or variant, add its image index digest to
`base-images.mk`. For a custom build, override `BASE_IMAGE` with a complete
`repository:tag@sha256:...` reference.
13 changes: 13 additions & 0 deletions base-images.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# Base image inputs shared by local builds and CI. Updated by wodby/images.
# Each digest identifies the complete multi-platform image index.
BASE_IMAGE_REPOSITORY := python
BASE_IMAGE_VERSION_SUFFIX := -alpine

BASE_IMAGE_DIGEST_3.10.21-alpine := sha256:07a3e27a565ce2397efe9a371c9cd8d675827cb1151fe12ffc7498b447712c56
BASE_IMAGE_DIGEST_3.11.16-alpine := sha256:0495f5559318affa673172ec7e35cd0a5213e4aaf4c76d0a66554c0af97b157e
BASE_IMAGE_DIGEST_3.12.14-alpine := sha256:c4634f578a412db396771b61b064c6e546c9d6414c7fb5b1b05d5871f1885f7b
BASE_IMAGE_DIGEST_3.13.15-alpine := sha256:1a63a53928ce53d2b0baf08092a703f4840ac5dfbd61fd48802dbf48e08c801e
BASE_IMAGE_DIGEST_3.14.7-alpine := sha256:016508ba505da24f7139765bc4bb669df4e88eb2f12eeadd571bf2f88d7533df

# Fail before building when a version or variant has no reviewed pin.
BASE_IMAGE = $(BASE_IMAGE_REPOSITORY):$(BASE_IMAGE_TAG)@$(or $(BASE_IMAGE_DIGEST_$(BASE_IMAGE_TAG)),$(error No base image digest for $(BASE_IMAGE_REPOSITORY):$(BASE_IMAGE_TAG); update base-images.mk))
Loading