fix: Pin Docker base images to SHA (#31)

fabriziofiorucci · web-flow · commit 37b4a781e108 · 2025-06-19T12:29:21.000Z
diff --git a/nginx-instance-manager/docker-deployment/Dockerfile.automated b/nginx-instance-manager/docker-deployment/Dockerfile.automated
@@ -1,4 +1,4 @@
-FROM ubuntu:20.04
+FROM ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214
 
 ARG ADD_PUM
 
diff --git a/nginx-instance-manager/docker-deployment/Dockerfile.manual b/nginx-instance-manager/docker-deployment/Dockerfile.manual
@@ -1,4 +1,4 @@
-FROM ubuntu:20.04
+FROM ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214
 
 ARG NIM_DEBFILE
 ARG SM_IMAGE=nim-files/.placeholder
diff --git a/nginx/api-steering/apiserver/Dockerfile b/nginx/api-steering/apiserver/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.12-slim
+FROM python:3.12-slim@sha256:e55523f127124e5edc03ba201e3dbbc85172a2ec40d8651ac752364b23dfd733
 
 WORKDIR /app
 COPY requirements.txt .
diff --git a/nginx/api-steering/backend/Dockerfile b/nginx/api-steering/backend/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.12-slim
+FROM python:3.12-slim@sha256:e55523f127124e5edc03ba201e3dbbc85172a2ec40d8651ac752364b23dfd733
 
 WORKDIR /app
 COPY requirements.txt .
diff --git a/nginx/api-steering/nginx/Dockerfile b/nginx/api-steering/nginx/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.19
+FROM alpine:3.19@sha256:e5d0aea7f7d2954678a9a6269ca2d06e06591881161961ea59e974dff3f12377
 
 LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
 
diff --git a/nginx/docker-image-builder/Dockerfile.oss b/nginx/docker-image-builder/Dockerfile.oss
@@ -1,4 +1,4 @@
-FROM nginx:stable-bullseye-perl
+FROM nginx:stable-bullseye-perl@sha256:fc78d87401fdbadf36c638febdad36ae17dd51d7b5d70bb0a34d94e0daa3a0e1
 
 ARG NMS_URL
 ARG NGINX_AGENT=false
diff --git a/nginx/docker-image-builder/Dockerfile.plus b/nginx/docker-image-builder/Dockerfile.plus
@@ -1,4 +1,4 @@
-FROM debian:bullseye-slim
+FROM debian:bullseye-slim@sha256:779034981fec838da124ff6ab9211499ba5d4e769dabdfd6c42c6ae2553b9a3b
 
 ARG NAP_WAF=false
 ARG NGINX_AGENT=false
diff --git a/nginx/docker-image-builder/Dockerfile.plus.unprivileged b/nginx/docker-image-builder/Dockerfile.plus.unprivileged
@@ -1,4 +1,4 @@
-FROM debian:bullseye-slim
+FROM debian:bullseye-slim@sha256:779034981fec838da124ff6ab9211499ba5d4e769dabdfd6c42c6ae2553b9a3b
 
 ARG NAP_WAF=false
 ARG NGINX_AGENT=false
diff --git a/nginx/multicloud-gateway/test-backend-db/Dockerfile b/nginx/multicloud-gateway/test-backend-db/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:latest
+FROM ubuntu:latest@sha256:b59d21599a2b151e23eea5f6602f4af4d7d31c4e236d22bf0b62b86d2e386b8f
 RUN apt-get update
 
 RUN apt-get install -y -q build-essential python3-pip python3-dev python3-simplejson git
diff --git a/nginx/soap-to-rest/nginx/Dockerfile b/nginx/soap-to-rest/nginx/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.17
+FROM alpine:3.17@sha256:8fc3dacfb6d69da8d44e42390de777e48577085db99aa4e4af35f483eb08b989
 
 LABEL maintainer="NGINX Docker Maintainers <docker-maint@nginx.com>"
 

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM ubuntu:20.04`
	`1`	`+FROM ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214`
`2`	`2`
`3`	`3`	`ARG ADD_PUM`
`4`	`4`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM python:3.12-slim`
	`1`	`+FROM python:3.12-slim@sha256:e55523f127124e5edc03ba201e3dbbc85172a2ec40d8651ac752364b23dfd733`
`2`	`2`
`3`	`3`	`WORKDIR /app`
`4`	`4`	`COPY requirements.txt .`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM alpine:3.19`
	`1`	`+FROM alpine:3.19@sha256:e5d0aea7f7d2954678a9a6269ca2d06e06591881161961ea59e974dff3f12377`
`2`	`2`
`3`	`3`	`LABEL maintainer="NGINX Docker Maintainers <[email protected]>"`
`4`	`4`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM nginx:stable-bullseye-perl`
	`1`	`+FROM nginx:stable-bullseye-perl@sha256:fc78d87401fdbadf36c638febdad36ae17dd51d7b5d70bb0a34d94e0daa3a0e1`
`2`	`2`
`3`	`3`	`ARG NMS_URL`
`4`	`4`	`ARG NGINX_AGENT=false`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM debian:bullseye-slim`
	`1`	`+FROM debian:bullseye-slim@sha256:779034981fec838da124ff6ab9211499ba5d4e769dabdfd6c42c6ae2553b9a3b`
`2`	`2`
`3`	`3`	`ARG NAP_WAF=false`
`4`	`4`	`ARG NGINX_AGENT=false`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM ubuntu:latest`
	`1`	`+FROM ubuntu:latest@sha256:b59d21599a2b151e23eea5f6602f4af4d7d31c4e236d22bf0b62b86d2e386b8f`
`2`	`2`	`RUN apt-get update`
`3`	`3`
`4`	`4`	`RUN apt-get install -y -q build-essential python3-pip python3-dev python3-simplejson git`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM alpine:3.17`
	`1`	`+FROM alpine:3.17@sha256:8fc3dacfb6d69da8d44e42390de777e48577085db99aa4e4af35f483eb08b989`
`2`	`2`
`3`	`3`	`LABEL maintainer="NGINX Docker Maintainers <[email protected]>"`
`4`	`4`