docker: unpinned FROM lines in config-renderer and knock Dockerfiles #289

New issue

Closed

opened 2026-09-19 22:43:59 -04:00 by mysticalsoap · 0 comments

mysticalsoap commented

2026-09-19 22:43:59 -04:00

Owner

Two Dockerfiles have unpinned FROM lines, against the digest-pinning policy every compose image: follows:

_helper/config-renderer/Dockerfile: FROM alpine:3
_helper/knock/Dockerfile: FROM python:3.14-alpine (the lldap stage in the same file is pinned)

Without a digest, Renovate has nothing to bump and a rebuild silently picks up whatever the tag points at that day. Pin both the way dagu/tools/Dockerfile and media/metadata/Dockerfile are. Depends on the rebuild fix landing first, or the pins change nothing live.

Two Dockerfiles have unpinned `FROM` lines, against the digest-pinning policy every compose `image:` follows: - `_helper/config-renderer/Dockerfile`: `FROM alpine:3` - `_helper/knock/Dockerfile`: `FROM python:3.14-alpine` (the lldap stage in the same file is pinned) Without a digest, Renovate has nothing to bump and a rebuild silently picks up whatever the tag points at that day. Pin both the way `dagu/tools/Dockerfile` and `media/metadata/Dockerfile` are. Depends on the rebuild fix landing first, or the pins change nothing live.

mysticalsoap added the

audit-work

label

2026-09-19 22:43:59 -04:00

mysticalsoap referenced this issue from a pull request that will close it,

2026-09-19 22:50:07 -04:00

docker: pin the two unpinned Dockerfile FROM lines #291

mysticalsoap closed this issue

2026-09-19 23:17:20 -04:00

mysticalsoap referenced this issue

2026-09-19 23:23:33 -04:00

apps: move knock and metadata out to their own repos, publish images to the Forgejo registry #292