Pin Docker container images by hash (#3678)

roger2hk · web-flow · commit f908fbcdc39e · 2024-11-20T16:35:36.000Z
diff --git a/examples/deployment/docker/db_server/Dockerfile b/examples/deployment/docker/db_server/Dockerfile
@@ -1,4 +1,4 @@
-FROM mysql:8.4
+FROM mysql:8.4@sha256:6bc3ac72e858ad6ecb651229520fe14848b885ed01b3f08e2b201a25a5f49476
 
 # TODO(roger2hk): Uncomment the below OS-level packages patch command as this is a temporary workaround to bypass the mysql8 gpg key rotation issue.
 # # Patch the OS-level packages and remove unneeded dependencies.
diff --git a/examples/deployment/docker/db_server/postgresql/Dockerfile b/examples/deployment/docker/db_server/postgresql/Dockerfile
@@ -1,4 +1,4 @@
-FROM postgres:latest
+FROM postgres:17.1@sha256:163763c8afd28cae69035ce84b12d8180179559c747c0701b3cad17818a0dbc5
 
 # expects the build context to be: $GOPATH/src/github.com/google/trillian
 COPY storage/postgresql/schema/storage.sql /docker-entrypoint-initdb.d/storage.sql

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM mysql:8.4`
	`1`	`+FROM mysql:8.4@sha256:6bc3ac72e858ad6ecb651229520fe14848b885ed01b3f08e2b201a25a5f49476`
`2`	`2`
`3`	`3`	`# TODO(roger2hk): Uncomment the below OS-level packages patch command as this is a temporary workaround to bypass the mysql8 gpg key rotation issue.`
`4`	`4`	`# # Patch the OS-level packages and remove unneeded dependencies.`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM postgres:latest`
	`1`	`+FROM postgres:17.1@sha256:163763c8afd28cae69035ce84b12d8180179559c747c0701b3cad17818a0dbc5`
`2`	`2`
`3`	`3`	`# expects the build context to be: $GOPATH/src/github.com/google/trillian`
`4`	`4`	`COPY storage/postgresql/schema/storage.sql /docker-entrypoint-initdb.d/storage.sql`