From faf6ee8281a50efecd83a73bb928b8a0ec722332 Mon Sep 17 00:00:00 2001 From: "renovate-update-app[bot]" <291053684+renovate-update-app[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 08:40:14 +0000 Subject: [PATCH] Pin dependencies --- .ci-builders/centos6-base/Dockerfile | 2 +- .ci-builders/centos7-base/Dockerfile | 2 +- .ci-builders/debian-base/Dockerfile | 2 +- .ci-builders/debian-rpmpublisher/Dockerfile | 2 +- .ci-builders/runner-circle-rpm/Dockerfile | 2 +- .ci-builders/runner7-circle-win/Dockerfile | 2 +- .devcontainer/Dockerfile | 8 ++++---- Dockerfiles/agent-ddot/Dockerfile.agent-otel | 2 +- Dockerfiles/agent/Dockerfile | 6 +++--- Dockerfiles/agent/windows/amd64/Dockerfile | 2 +- Dockerfiles/base-image/Dockerfile | 2 +- Dockerfiles/cluster-agent/Dockerfile | 6 +++--- Dockerfiles/ddot-ebpf/Dockerfile | 2 +- Dockerfiles/dogstatsd/alpine/Dockerfile | 2 +- Dockerfiles/local_builder/Dockerfile | 2 +- Dockerfiles/otel-agent/Dockerfile | 2 +- tools/host-profiler/Dockerfile | 2 +- 17 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.ci-builders/centos6-base/Dockerfile b/.ci-builders/centos6-base/Dockerfile index 90d998c75a31..67bfc69bc500 100644 --- a/.ci-builders/centos6-base/Dockerfile +++ b/.ci-builders/centos6-base/Dockerfile @@ -1,4 +1,4 @@ -FROM centos:6 +FROM centos:6@sha256:a93df2e96e07f56ea48f215425c6f1673ab922927894595bb5c0ee4c5a955133 # Build Args ARG GIMME_GO_VERSION=1.16.7 diff --git a/.ci-builders/centos7-base/Dockerfile b/.ci-builders/centos7-base/Dockerfile index fd890c80d9ee..7b9f75cfece9 100644 --- a/.ci-builders/centos7-base/Dockerfile +++ b/.ci-builders/centos7-base/Dockerfile @@ -1,4 +1,4 @@ -FROM centos:7 +FROM centos:7@sha256:be65f488b7764ad3638f236b7b515b3678369a5124c47b8d32916d6487418ea4 # Build Args ARG GIMME_GO_VERSION=1.16.7 diff --git a/.ci-builders/debian-base/Dockerfile b/.ci-builders/debian-base/Dockerfile index 0a3deb1dd9ef..8d3c596b1fe5 100644 --- a/.ci-builders/debian-base/Dockerfile +++ b/.ci-builders/debian-base/Dockerfile @@ -1,5 +1,5 @@ #FROM debian:wheezy-backports -FROM golang:1.16.7-stretch +FROM golang:1.18.3-stretch@sha256:a9718cb62e77cc03411ea11fd71f3541e508f211169dd8f8d69ba2036545cd80 RUN sed -i 's/^#\s*\(deb.*universe\)$/\1/g' /etc/apt/sources.list \ && sed -i 's/^#\s*\(deb.*multiverse\)$/\1/g' /etc/apt/sources.list \ diff --git a/.ci-builders/debian-rpmpublisher/Dockerfile b/.ci-builders/debian-rpmpublisher/Dockerfile index e29f0cdd670f..1b5a64af8a09 100644 --- a/.ci-builders/debian-rpmpublisher/Dockerfile +++ b/.ci-builders/debian-rpmpublisher/Dockerfile @@ -1,4 +1,4 @@ -FROM docker.io/python:3.10.4-slim-buster +FROM docker.io/python:3.11.4-slim-buster@sha256:c46b0ae5728c2247b99903098ade3176a58e274d9c7d2efeaaab3e0621a53935 RUN pip install boto3==1.8.0 sts-rpm-s3==0.3.3 invoke==1.7.0 distro==1.4.0 awscli==1.16 RUN apt update && apt-get install -y libkrb5-dev unixodbc-dev rpm python-deltarpm createrepo yum-utils gnupg2 diff --git a/.ci-builders/runner-circle-rpm/Dockerfile b/.ci-builders/runner-circle-rpm/Dockerfile index df691415d674..124579d72cff 100644 --- a/.ci-builders/runner-circle-rpm/Dockerfile +++ b/.ci-builders/runner-circle-rpm/Dockerfile @@ -1,4 +1,4 @@ -FROM centos:6 +FROM centos:6@sha256:a93df2e96e07f56ea48f215425c6f1673ab922927894595bb5c0ee4c5a955133 ENV SYSTEMD_VERSION=219 ENV GIT_VERSION=2.21.0 diff --git a/.ci-builders/runner7-circle-win/Dockerfile b/.ci-builders/runner7-circle-win/Dockerfile index 1ae2e2152df3..045721a4d6ef 100644 --- a/.ci-builders/runner7-circle-win/Dockerfile +++ b/.ci-builders/runner7-circle-win/Dockerfile @@ -11,7 +11,7 @@ # On the contrary, since our 1909 windows-docker host image does have this update, # we use a base container image that does have this update. # TODO: Once the 1809 windows-docker host image is updated, update the base container image. -ARG BASE_IMAGE=mcr.microsoft.com/dotnet/framework/runtime:4.8-20200114-windowsservercore-ltsc2019 +ARG BASE_IMAGE=mcr.microsoft.com/dotnet/framework/runtime:4.8-20200114-windowsservercore-ltsc2019@sha256:85433707a809232402827a359c80d0aa08226e7833aa2914be2113e694d2b6ae FROM ${BASE_IMAGE} diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 794e486b51ff..3d12bd69f841 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -1,14 +1,14 @@ ARG DEBIAN_VERSION=bullseye-slim -ARG DOCKER_VERSION=20.10.2 -ARG DOCKER_COMPOSE_VERSION=debian-1.28.4 +ARG DOCKER_VERSION=20.10.24@sha256:2967f0819c84dd589ed0a023b9d25dcfe7a3c123d5bf784ffbb77edf55335f0c +ARG DOCKER_COMPOSE_VERSION=debian-1.28.4@sha256:30ee50f1bde2414b58bc5f643a790a0ca07ce8cb533402d166511f5096b603d8 ARG GOLANG_VERSION=1.15 -ARG GOLANGCI_LINT_VERSION=v1.42.1 +ARG GOLANGCI_LINT_VERSION=v1.64.8@sha256:2987913e27f4eca9c8a39129d2c7bc1e74fbcf77f181e01cea607be437aa5cb8 FROM docker:${DOCKER_VERSION} AS docker-cli FROM docker/compose:${DOCKER_COMPOSE_VERSION} AS docker-compose FROM golangci/golangci-lint:${GOLANGCI_LINT_VERSION} as golangci-lint -FROM golang:latest +FROM golang:latest@sha256:9048d5e7751706200eb1719c7dae0436950d362f29a1da91fa05e5c63867c60f # Configure to avoid build warnings and errors as described in official VSCode Remote-Containers extension documentation. # See https://code.visualstudio.com/docs/remote/containers-advanced#_reducing-dockerfile-build-warnings. diff --git a/Dockerfiles/agent-ddot/Dockerfile.agent-otel b/Dockerfiles/agent-ddot/Dockerfile.agent-otel index 81823c2776a7..4c616eb3e65d 100644 --- a/Dockerfiles/agent-ddot/Dockerfile.agent-otel +++ b/Dockerfiles/agent-ddot/Dockerfile.agent-otel @@ -1,7 +1,7 @@ # check=skip=SecretsUsedInArgOrEnv ARG AGENT_DOCKER_REPO=datadog/agent ARG AGENT_VERSION=7.72.2 -ARG UBUNTU_VERSION=24.04 +ARG UBUNTU_VERSION=24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c ARG AGENT_DOCKER_TAG=${AGENT_VERSION}-full ARG AGENT_GIT_REF=${AGENT_VERSION} ARG BASE_IMAGE_REGISTRY=docker.io diff --git a/Dockerfiles/agent/Dockerfile b/Dockerfiles/agent/Dockerfile index 15060b7decd8..7ac57f633ac9 100644 --- a/Dockerfiles/agent/Dockerfile +++ b/Dockerfiles/agent/Dockerfile @@ -1,5 +1,5 @@ ARG BASE_IMAGE_REGISTRY=registry.tooling.stackstate.io/docker/library -ARG BASE_IMAGE_UBUNTU_VERSION=24.04 +ARG BASE_IMAGE_UBUNTU_VERSION=24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c ARG BCI_IMAGE_REGISTRY=registry.tooling.stackstate.io/suse/bci ########################################## @@ -28,7 +28,7 @@ RUN dpkg -x /stackstate-agent*_${ARCH}.deb . \ # - copy default config files COPY stackstate*.yaml etc/stackstate-agent/ -FROM ${BCI_IMAGE_REGISTRY}/bci-base:15.7 AS software +FROM ${BCI_IMAGE_REGISTRY}/bci-base:15.7@sha256:79595412dc8da75bac1a5f9cc75c7d579523dbeeb6fc594d10b22967819760c3 AS software # as per comment here: https://github.com/rancher/rancher/blob/main/package/Dockerfile#L12 # No-op command to create an explicit layer - this fixes a weird buildkit/buildx bug on macos arm RUN : @@ -36,7 +36,7 @@ RUN : # Actual docker image construction # #################################### -FROM ${BCI_IMAGE_REGISTRY}/bci-micro:15.7 +FROM ${BCI_IMAGE_REGISTRY}/bci-micro:15.7@sha256:f1427da6f40791aa5a9f73bb339674970ea93a2b158adc81bc99bcd1b7899a74 LABEL maintainer="StackState " # Install system packages using builder image that has zypper diff --git a/Dockerfiles/agent/windows/amd64/Dockerfile b/Dockerfiles/agent/windows/amd64/Dockerfile index 761622272959..7219eb23c8d8 100755 --- a/Dockerfiles/agent/windows/amd64/Dockerfile +++ b/Dockerfiles/agent/windows/amd64/Dockerfile @@ -1,4 +1,4 @@ -ARG BASE_IMAGE=mcr.microsoft.com/powershell:lts-windowsservercore-1809 +ARG BASE_IMAGE=mcr.microsoft.com/powershell:lts-windowsservercore-1809@sha256:cc2aebf0b8986f5c7cc10537072904da14cdcba7ad2cac227519849dc75d25c7 FROM ${BASE_IMAGE} ARG BASE_IMAGE ARG BASE_IMAGE_OS="windows server core" diff --git a/Dockerfiles/base-image/Dockerfile b/Dockerfiles/base-image/Dockerfile index 39be9c436d5e..150985b3cea4 100644 --- a/Dockerfiles/base-image/Dockerfile +++ b/Dockerfiles/base-image/Dockerfile @@ -1,4 +1,4 @@ -ARG BASE_IMAGE_UBUNTU_VERSION=24.04 +ARG BASE_IMAGE_UBUNTU_VERSION=24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c ARG BASE_IMAGE_UBUNTU_NAME=noble ARG BASE_IMAGE_REGISTRY=docker.io diff --git a/Dockerfiles/cluster-agent/Dockerfile b/Dockerfiles/cluster-agent/Dockerfile index 783c7042e7ab..bb1e5c2a42b9 100644 --- a/Dockerfiles/cluster-agent/Dockerfile +++ b/Dockerfiles/cluster-agent/Dockerfile @@ -5,7 +5,7 @@ ARG BCI_IMAGE_REGISTRY=registry.tooling.stackstate.io/suse/bci # Preparation stage: layout and chmods # ######################################## -FROM ${BASE_IMAGE_REGISTRY}/ubuntu:20.04 as builder +FROM ${BASE_IMAGE_REGISTRY}/ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214 as builder WORKDIR /output @@ -25,12 +25,12 @@ RUN chmod 755 entrypoint.sh \ # Actual docker image construction # #################################### -FROM ${BCI_IMAGE_REGISTRY}/bci-base:15.7 AS software +FROM ${BCI_IMAGE_REGISTRY}/bci-base:15.7@sha256:79595412dc8da75bac1a5f9cc75c7d579523dbeeb6fc594d10b22967819760c3 AS software # as per comment here: https://github.com/rancher/rancher/blob/main/package/Dockerfile#L12 # No-op command to create an explicit layer - this fixes a weird buildkit/buildx bug on macos arm RUN : -FROM ${BCI_IMAGE_REGISTRY}/bci-micro:15.7 AS final +FROM ${BCI_IMAGE_REGISTRY}/bci-micro:15.7@sha256:f1427da6f40791aa5a9f73bb339674970ea93a2b158adc81bc99bcd1b7899a74 AS final LABEL maintainer="StackState " ARG user="stackstate-agent" diff --git a/Dockerfiles/ddot-ebpf/Dockerfile b/Dockerfiles/ddot-ebpf/Dockerfile index 0ce584adc408..113bb854ec88 100644 --- a/Dockerfiles/ddot-ebpf/Dockerfile +++ b/Dockerfiles/ddot-ebpf/Dockerfile @@ -1,4 +1,4 @@ -ARG BASE_IMAGE_UBUNTU_VERSION=24.04 +ARG BASE_IMAGE_UBUNTU_VERSION=24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c ARG BASE_IMAGE_UBUNTU_NAME=noble ARG BASE_IMAGE_REGISTRY=docker.io ARG AGENT_BASE_IMAGE_TAG diff --git a/Dockerfiles/dogstatsd/alpine/Dockerfile b/Dockerfiles/dogstatsd/alpine/Dockerfile index 5da390084275..67a5a03dd1a2 100644 --- a/Dockerfiles/dogstatsd/alpine/Dockerfile +++ b/Dockerfiles/dogstatsd/alpine/Dockerfile @@ -1,4 +1,4 @@ -ARG BASE_IMAGE_ALPINE_VERSION=3.23.3 +ARG BASE_IMAGE_ALPINE_VERSION=3.24.3@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a ARG BASE_IMAGE_REGISTRY=public.ecr.aws/docker FROM ${BASE_IMAGE_REGISTRY}/library/alpine:$BASE_IMAGE_ALPINE_VERSION AS release-base diff --git a/Dockerfiles/local_builder/Dockerfile b/Dockerfiles/local_builder/Dockerfile index 145bf9a84482..b4dc35a7451b 100644 --- a/Dockerfiles/local_builder/Dockerfile +++ b/Dockerfiles/local_builder/Dockerfile @@ -1,4 +1,4 @@ -FROM registry.tooling.stackstate.io/quay/stackstate/stackstate-agent-runner-gitlab:debian-20220826-patched-20230511 +FROM registry.tooling.stackstate.io/quay/stackstate/stackstate-agent-runner-gitlab:debian-20220826-patched-20230511@sha256:447fceec0c84a113338551192030b812e392a5abde2032b24b0f81dc27398e89 ARG UID ARG GID diff --git a/Dockerfiles/otel-agent/Dockerfile b/Dockerfiles/otel-agent/Dockerfile index 8882043ee13d..f0a86e466128 100644 --- a/Dockerfiles/otel-agent/Dockerfile +++ b/Dockerfiles/otel-agent/Dockerfile @@ -1,4 +1,4 @@ -ARG BASE_IMAGE_UBUNTU_VERSION=24.04 +ARG BASE_IMAGE_UBUNTU_VERSION=24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c ARG BASE_IMAGE_UBUNTU_NAME=noble ARG BASE_IMAGE_REGISTRY=docker.io ARG AGENT_BASE_IMAGE_TAG diff --git a/tools/host-profiler/Dockerfile b/tools/host-profiler/Dockerfile index 1aed16a09003..cd2c37f3b0fa 100755 --- a/tools/host-profiler/Dockerfile +++ b/tools/host-profiler/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.10-trixie +FROM golang:1.27.3-trixie@sha256:c124b9ad3452f46061b5054607d26ea51730dae5372c5e469920063ba2bc6dcc RUN cross_debian_arch=$(uname -m | sed -e 's/aarch64/amd64/' -e 's/x86_64/arm64/'); \ cross_pkg_arch=$(uname -m | sed -e 's/aarch64/x86-64/' -e 's/x86_64/aarch64/'); \