From cdbe40143deec8a3a2bd37d1fe0bfd1f30e27e54 Mon Sep 17 00:00:00 2001 From: "authentik-automation[bot]" <135050075+authentik-automation[bot]@users.noreply.github.com> Date: Wed, 29 Oct 2025 14:01:28 +0100 Subject: [PATCH] root: use hashes for dockerfile FROM (cherry-pick #17795 to version-2025.10) (#17798) * Cherry-pick #17795 to version-2025.10 (with conflicts) This cherry-pick has conflicts that need manual resolution. Original PR: #17795 Original commit: 6f35c32190b1fac349bd9fc35f414fec298b79ef * fix conflict Signed-off-by: Jens L. --------- Signed-off-by: Jens L. Co-authored-by: Jens L. --- .github/dependabot.yml | 4 +++- Dockerfile | 10 +++++----- ldap.Dockerfile | 4 ++-- proxy.Dockerfile | 4 ++-- rac.Dockerfile | 4 ++-- radius.Dockerfile | 4 ++-- website/Dockerfile | 4 ++-- 7 files changed, 18 insertions(+), 16 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6eeec40d60..4e3d979424 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -142,7 +142,9 @@ updates: labels: - dependencies - package-ecosystem: docker - directory: "/" + directories: + - / + - /website schedule: interval: daily time: "04:00" diff --git a/Dockerfile b/Dockerfile index 7239f1a0a8..e772280c0b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ # syntax=docker/dockerfile:1 # Stage 1: Build webui -FROM --platform=${BUILDPLATFORM} docker.io/library/node:24-slim AS node-builder +FROM --platform=${BUILDPLATFORM} docker.io/library/node:24-trixie-slim@sha256:45babd1b4ce0349fb12c4e24bf017b90b96d52806db32e001e3013f341bef0fe AS node-builder ARG GIT_BUILD_HASH ENV GIT_BUILD_HASH=$GIT_BUILD_HASH @@ -26,7 +26,7 @@ RUN npm run build && \ npm run build:sfe # Stage 2: Build go proxy -FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.25.3-bookworm AS go-builder +FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.25.3-trixie@sha256:7534a6264850325fcce93e47b87a0e3fddd96b308440245e6ab1325fa8a44c91 AS go-builder ARG TARGETOS ARG TARGETARCH @@ -63,7 +63,7 @@ RUN --mount=type=cache,sharing=locked,target=/go/pkg/mod \ go build -o /go/authentik ./cmd/server # Stage 3: MaxMind GeoIP -FROM --platform=${BUILDPLATFORM} ghcr.io/maxmind/geoipupdate:v7.1.1 AS geoip +FROM --platform=${BUILDPLATFORM} ghcr.io/maxmind/geoipupdate:v7.1.1@sha256:faecdca22579730ab0b7dea5aa9af350bb3c93cb9d39845c173639ead30346d2 AS geoip ENV GEOIPUPDATE_EDITION_IDS="GeoLite2-City GeoLite2-ASN" ENV GEOIPUPDATE_VERBOSE="1" @@ -76,9 +76,9 @@ RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \ /bin/sh -c "GEOIPUPDATE_LICENSE_KEY_FILE=/run/secrets/GEOIPUPDATE_LICENSE_KEY /usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0" # Stage 4: Download uv -FROM ghcr.io/astral-sh/uv:0.9.4 AS uv +FROM ghcr.io/astral-sh/uv:0.9.5@sha256:f459f6f73a8c4ef5d69f4e6fbbdb8af751d6fa40ec34b39a1ab469acd6e289b7 AS uv # Stage 5: Base python image -FROM ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips AS python-base +FROM ghcr.io/goauthentik/fips-python:3.13.9-slim-trixie-fips@sha256:700fc8c1e290bd14e5eaca50b1d8e8c748c820010559cbfb4c4f8dfbe2c4c9ff AS python-base ENV VENV_PATH="/ak-root/.venv" \ PATH="/lifecycle:/ak-root/.venv/bin:$PATH" \ diff --git a/ldap.Dockerfile b/ldap.Dockerfile index 0d9c900b62..f6fe3c55fa 100644 --- a/ldap.Dockerfile +++ b/ldap.Dockerfile @@ -1,7 +1,7 @@ # syntax=docker/dockerfile:1 # Stage 1: Build -FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.25.3-bookworm AS builder +FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.25.3-trixie@sha256:7534a6264850325fcce93e47b87a0e3fddd96b308440245e6ab1325fa8a44c91 AS builder ARG TARGETOS ARG TARGETARCH @@ -31,7 +31,7 @@ RUN --mount=type=cache,sharing=locked,target=/go/pkg/mod \ go build -o /go/ldap ./cmd/ldap # Stage 2: Run -FROM ghcr.io/goauthentik/fips-debian:bookworm-slim-fips +FROM ghcr.io/goauthentik/fips-debian:trixie-slim-fips@sha256:9b4cedf932e97194f1825124830f2eec14254d90162dad28f97e505971543115 ARG VERSION ARG GIT_BUILD_HASH diff --git a/proxy.Dockerfile b/proxy.Dockerfile index 1bfacd26de..4ba700e804 100644 --- a/proxy.Dockerfile +++ b/proxy.Dockerfile @@ -17,7 +17,7 @@ COPY web . RUN npm run build-proxy # Stage 2: Build -FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.25.3-bookworm AS builder +FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.25.3-trixie@sha256:7534a6264850325fcce93e47b87a0e3fddd96b308440245e6ab1325fa8a44c91 AS builder ARG TARGETOS ARG TARGETARCH @@ -47,7 +47,7 @@ RUN --mount=type=cache,sharing=locked,target=/go/pkg/mod \ go build -o /go/proxy ./cmd/proxy # Stage 3: Run -FROM ghcr.io/goauthentik/fips-debian:bookworm-slim-fips +FROM ghcr.io/goauthentik/fips-debian:trixie-slim-fips@sha256:9b4cedf932e97194f1825124830f2eec14254d90162dad28f97e505971543115 ARG VERSION ARG GIT_BUILD_HASH diff --git a/rac.Dockerfile b/rac.Dockerfile index f830866095..bdae210257 100644 --- a/rac.Dockerfile +++ b/rac.Dockerfile @@ -1,7 +1,7 @@ # syntax=docker/dockerfile:1 # Stage 1: Build -FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.25.3-bookworm AS builder +FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.25.3-trixie@sha256:7534a6264850325fcce93e47b87a0e3fddd96b308440245e6ab1325fa8a44c91 AS builder ARG TARGETOS ARG TARGETARCH @@ -31,7 +31,7 @@ RUN --mount=type=cache,sharing=locked,target=/go/pkg/mod \ go build -o /go/rac ./cmd/rac # Stage 2: Run -FROM ghcr.io/goauthentik/guacd:v1.6.0-fips +FROM ghcr.io/goauthentik/guacd:v1.6.0-fips@sha256:1d99572b0260924149b8c923c021a32016f885fcea6d5cc8d58f718dfdc7a2dd ARG VERSION ARG GIT_BUILD_HASH diff --git a/radius.Dockerfile b/radius.Dockerfile index 6d1bedf09b..b47e5900c9 100644 --- a/radius.Dockerfile +++ b/radius.Dockerfile @@ -1,7 +1,7 @@ # syntax=docker/dockerfile:1 # Stage 1: Build -FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.25.3-bookworm AS builder +FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.25.3-trixie@sha256:7534a6264850325fcce93e47b87a0e3fddd96b308440245e6ab1325fa8a44c91 AS builder ARG TARGETOS ARG TARGETARCH @@ -31,7 +31,7 @@ RUN --mount=type=cache,sharing=locked,target=/go/pkg/mod \ go build -o /go/radius ./cmd/radius # Stage 2: Run -FROM ghcr.io/goauthentik/fips-debian:bookworm-slim-fips +FROM ghcr.io/goauthentik/fips-debian:trixie-slim-fips@sha256:9b4cedf932e97194f1825124830f2eec14254d90162dad28f97e505971543115 ARG VERSION ARG GIT_BUILD_HASH diff --git a/website/Dockerfile b/website/Dockerfile index 207f338c75..4d704f8cb1 100644 --- a/website/Dockerfile +++ b/website/Dockerfile @@ -1,4 +1,4 @@ -FROM --platform=${BUILDPLATFORM} docker.io/library/node:24-slim AS docs-builder +FROM --platform=${BUILDPLATFORM} docker.io/library/node:24-trixie-slim@sha256:45babd1b4ce0349fb12c4e24bf017b90b96d52806db32e001e3013f341bef0fe AS docs-builder ENV NODE_ENV=production @@ -21,6 +21,6 @@ COPY ./SECURITY.md /work/ RUN npm run build -FROM docker.io/library/nginx:1.29.0 +FROM docker.io/library/nginx:1.29-trixie@sha256:b619c34a163ac12f68c1982568a122c4953dbf3126b8dbf0cc2f6fdbfd85de27 COPY --from=docs-builder /work/website/docs/build /usr/share/nginx/html