Skip to content

build(deps): Bump the docker-images group across 4 directories with 5 updates #375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

build(deps): Bump the docker-images group across 4 directories with 5 updates #375

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions crates/registry-relay/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# syntax=docker/dockerfile:1.7

# Keep the tag for humans and the digest for reproducible pulls.
FROM rust:1-bookworm@sha256:6258907abe69656e41cd992e0b705cdcfabcbbe3db374f92ed2d47121282d4a1 AS builder
FROM rust:1-bookworm@sha256:8fa55b2f3ddf97471ab6a767bfa3f37e6bad0986ba823e75fea57e2a2a5c3073 AS builder
WORKDIR /workspace/registry_relay

COPY Cargo.toml Cargo.lock ./
Expand Down Expand Up @@ -34,7 +34,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
chown -R 65532:65532 /workspace/runtime-root

# Distroless cc keeps glibc and CA certificates while dropping shell/package tools.
FROM gcr.io/distroless/cc-debian12:nonroot@sha256:bd2899c12b335c827750ccf2359879eab09c09b206023dcebea408947d54127c AS runtime
FROM gcr.io/distroless/cc-debian12:nonroot@sha256:66aa873a4a14fb164aa01296058efd8253744606d72715e45acface073359faa AS runtime

COPY --from=builder --chown=65532:65532 /workspace/runtime-root/ /
COPY --from=builder /usr/local/bin/registry-relay /usr/local/bin/registry-relay
Expand Down
4 changes: 2 additions & 2 deletions crates/registry-relay/Dockerfile.demo
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# syntax=docker/dockerfile:1.7

# Keep the tag for humans and the digest for reproducible pulls.
FROM rust:1-bookworm@sha256:6258907abe69656e41cd992e0b705cdcfabcbbe3db374f92ed2d47121282d4a1 AS builder
FROM rust:1-bookworm@sha256:8fa55b2f3ddf97471ab6a767bfa3f37e6bad0986ba823e75fea57e2a2a5c3073 AS builder
WORKDIR /workspace/registry_relay

COPY Cargo.toml Cargo.lock ./
Expand All @@ -17,7 +17,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
cp /workspace/registry_relay/target/release/registry-relay /usr/local/bin/registry-relay && \
cp /workspace/registry_relay/target/release/registry-relay-rhai-worker /usr/local/bin/registry-relay-rhai-worker

FROM debian:bookworm-slim@sha256:0104b334637a5f19aa9c983a91b54c89887c0984081f2068983107a6f6c21eeb AS runtime
FROM debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818 AS runtime

RUN groupadd --system --gid 10001 registry_relay && \
useradd --system --uid 10001 --gid registry_relay --home-dir /var/lib/registry-relay --shell /usr/sbin/nologin registry_relay && \
Expand Down
4 changes: 2 additions & 2 deletions products/notary/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
# syntax=docker/dockerfile:1.7

# Keep the tag for humans and the digest for reproducible pulls.
FROM rust:1-bookworm@sha256:54152db00aafd37bc5ce1f3585aaa42f17cdd5c8e5ef9eabfbc0718b42bce312 AS builder
FROM rust:1-bookworm@sha256:8fa55b2f3ddf97471ab6a767bfa3f37e6bad0986ba823e75fea57e2a2a5c3073 AS builder

WORKDIR /workspace/registry-notary
COPY --from=registry-platform Cargo.toml README.md LICENSE /workspace/registry-platform/
Expand Down Expand Up @@ -32,7 +32,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
# Runtime policy: the main Notary image is a distroless Rust service image.
# Keep the runtime shell-free, non-root, and compatible with binary healthchecks
# and JSON-array entrypoints. CI enforces this policy.
FROM gcr.io/distroless/cc-debian12:nonroot@sha256:b0ae8e989418b458e0f25489bc3be523718938a2b70864cc0f6a00af1ddbd985 AS runtime
FROM gcr.io/distroless/cc-debian12:nonroot@sha256:66aa873a4a14fb164aa01296058efd8253744606d72715e45acface073359faa AS runtime

COPY --from=builder /workspace/out/ /usr/local/bin/

Expand Down
2 changes: 1 addition & 1 deletion release/conformance/openid/nginx.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM nginx:1.27.3@sha256:bc2f6a7c8ddbccf55bdb19659ce3b0a92ca6559e86d42677a5a02ef6bda2fcef
FROM nginx:1.31.3@sha256:5a88c9c45479443d7be2eadc894b4ed0a9801bae03d97a5760ae13b5c2005942

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep conformance image pins in sync with tests

In the release conformance tests I inspected (release/scripts/test_openid_conformance_runner.py::test_runtime_override_pins_built_image_bases), the runner still asserts nginx:1.27.3@sha256: and then eclipse-temurin:21@sha256:. With this image bump, the documented release check python3 -m unittest release/scripts/test_openid_conformance_runner.py fails on the nginx assertion, and the Java assertion is stale as well, so this commit cannot pass the release gate unless the expected pins are updated or the base bumps are reverted.

Useful? React with 👍 / 👎.


RUN openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
-keyout /etc/ssl/private/nginx-selfsigned.key \
Expand Down
2 changes: 1 addition & 1 deletion release/conformance/openid/server-dev.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Mirrors the pinned suite's development server image while fixing its base.
FROM eclipse-temurin:21@sha256:da9d3a4f7650db39b918fc5a2c3da76556fb8cc8e5f3767cdea0bb409286951a
FROM eclipse-temurin:25@sha256:201fbb8886b2d273218aa3a192f0afbf7b5ff65ee8cc6ef47f5dce2171f013ea

RUN apt-get update \
&& apt-get install -y --no-install-recommends redir=3.3-1build1 \
Expand Down
2 changes: 1 addition & 1 deletion release/docker/Dockerfile.registry-notary
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

# syntax=docker/dockerfile:1.7

FROM debian:bookworm-slim@sha256:60eac759739651111db372c07be67863818726f754804b8707c90979bda511df AS runtime
FROM debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818 AS runtime

RUN apt-get update \
&& apt-get install -y --no-install-recommends ca-certificates \
Expand Down
4 changes: 2 additions & 2 deletions release/docker/Dockerfile.registry-relay
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# syntax=docker/dockerfile:1.7

FROM debian:bookworm-slim@sha256:60eac759739651111db372c07be67863818726f754804b8707c90979bda511df AS runtime-root
FROM debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818 AS runtime-root

RUN mkdir -p \
/workspace/runtime-root/etc/registry-relay \
Expand All @@ -9,7 +9,7 @@ RUN mkdir -p \
/workspace/runtime-root/var/log/registry-relay && \
chown -R 65532:65532 /workspace/runtime-root

FROM gcr.io/distroless/cc-debian12:nonroot@sha256:ce0d66bc0f64aae46e6a03add867b07f42cc7b8799c949c2e898057b7f75a151 AS runtime
FROM gcr.io/distroless/cc-debian12:nonroot@sha256:66aa873a4a14fb164aa01296058efd8253744606d72715e45acface073359faa AS runtime

COPY --from=runtime-root --chown=65532:65532 /workspace/runtime-root/ /
COPY --chmod=0755 dist/image-bin/registry-relay /usr/local/bin/registry-relay
Expand Down
Loading