Skip to content

Pin server image base by digest #129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
den-sq merged 1 commit into from
Aug 14, 2026
Merged

Pin server image base by digest #129

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions documentation/docs/development/registry-server-images.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,14 @@ The `Publish Server Image` workflow builds the Python wheel, builds `python/Dock

Both tags are produced from the same wheel artifact that the Dockerfile installs.

## Base Image Pin

Both Python Dockerfiles keep the readable `thehale/python-poetry` tag paired
with an immutable digest. When upgrading that base, review the upstream image,
resolve the new tag's digest, and update the tag and digest in
`python/Dockerfile` and `python/Dockerfile-prod` together in the same reviewed
change. Do not refresh the digest without an intentional base-image review.

## Release Compose Usage

Release packaging uses `npm run prepare:production-server` to write
Expand Down
4 changes: 2 additions & 2 deletions python/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM thehale/python-poetry:2.1.3-py3.11-slim AS builder
FROM thehale/python-poetry:2.1.3-py3.11-slim@sha256:4e091da0d71700b404a2844ac3bbd4aaa3450a6421c469935ae165d41252a964 AS builder

ENV POETRY_NO_INTERACTION=1 \
POETRY_VIRTUALENVS_IN_PROJECT=1 \
Expand Down Expand Up @@ -26,4 +26,4 @@ ENV VIRTUAL_ENV=/app/.venv \

COPY ./ouroboros ./ouroboros

ENTRYPOINT ["python", "-m", "ouroboros.docker_server"]
ENTRYPOINT ["python", "-m", "ouroboros.docker_server"]
4 changes: 2 additions & 2 deletions python/Dockerfile-prod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

# Assumes that dist/*.whl has been built

FROM thehale/python-poetry:2.1.3-py3.11-slim AS python-base
FROM thehale/python-poetry:2.1.3-py3.11-slim@sha256:4e091da0d71700b404a2844ac3bbd4aaa3450a6421c469935ae165d41252a964 AS python-base

ENV DCONF_DISABLE_ASYNC=1

Expand All @@ -18,4 +18,4 @@ COPY ./dist/*.whl ./

RUN pip install *.whl

CMD ["ouroboros-docker-server"]
CMD ["ouroboros-docker-server"]
Loading