renovate-update-app · Oct 26, 2026
diff --git a/.ci-builders/centos6-base/Dockerfile b/.ci-builders/centos6-base/Dockerfile
@@ -1,4 +1,4 @@
-FROM centos:6
+FROM centos:6@sha256:a93df2e96e07f56ea48f215425c6f1673ab922927894595bb5c0ee4c5a955133
 
 # Build Args
 ARG GIMME_GO_VERSION=1.16.7

diff --git a/.ci-builders/centos7-base/Dockerfile b/.ci-builders/centos7-base/Dockerfile
@@ -1,4 +1,4 @@
-FROM centos:7
+FROM centos:7@sha256:be65f488b7764ad3638f236b7b515b3678369a5124c47b8d32916d6487418ea4
 
 # Build Args
 ARG GIMME_GO_VERSION=1.16.7

diff --git a/.ci-builders/debian-base/Dockerfile b/.ci-builders/debian-base/Dockerfile
@@ -1,5 +1,5 @@
 #FROM debian:wheezy-backports
-FROM golang:1.16.7-stretch
+FROM golang:1.18.3-stretch@sha256:a9718cb62e77cc03411ea11fd71f3541e508f211169dd8f8d69ba2036545cd80
 
 RUN sed -i 's/^#\s*\(deb.*universe\)$/\1/g' /etc/apt/sources.list \
     && sed -i 's/^#\s*\(deb.*multiverse\)$/\1/g' /etc/apt/sources.list \

diff --git a/.ci-builders/debian-rpmpublisher/Dockerfile b/.ci-builders/debian-rpmpublisher/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/python:3.10.4-slim-buster
+FROM docker.io/python:3.11.4-slim-buster@sha256:c46b0ae5728c2247b99903098ade3176a58e274d9c7d2efeaaab3e0621a53935
 
 RUN pip install boto3==1.8.0 sts-rpm-s3==0.3.3 invoke==1.7.0 distro==1.4.0 awscli==1.16
 RUN apt update  && apt-get install -y libkrb5-dev unixodbc-dev rpm python-deltarpm createrepo yum-utils gnupg2

diff --git a/.ci-builders/runner-circle-rpm/Dockerfile b/.ci-builders/runner-circle-rpm/Dockerfile
@@ -1,4 +1,4 @@
-FROM centos:6
+FROM centos:6@sha256:a93df2e96e07f56ea48f215425c6f1673ab922927894595bb5c0ee4c5a955133
 
 ENV SYSTEMD_VERSION=219
 ENV GIT_VERSION=2.21.0

diff --git a/.ci-builders/runner7-circle-win/Dockerfile b/.ci-builders/runner7-circle-win/Dockerfile
@@ -11,7 +11,7 @@
 # On the contrary, since our 1909 windows-docker host image does have this update,
 # we use a base container image that does have this update.
 # TODO: Once the 1809 windows-docker host image is updated, update the base container image.
-ARG BASE_IMAGE=mcr.microsoft.com/dotnet/framework/runtime:4.8-20200114-windowsservercore-ltsc2019
+ARG BASE_IMAGE=mcr.microsoft.com/dotnet/framework/runtime:4.8-20200114-windowsservercore-ltsc2019@sha256:85433707a809232402827a359c80d0aa08226e7833aa2914be2113e694d2b6ae
 
 FROM ${BASE_IMAGE}
 

diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
@@ -1,14 +1,14 @@
 ARG DEBIAN_VERSION=bullseye-slim
-ARG DOCKER_VERSION=20.10.2
-ARG DOCKER_COMPOSE_VERSION=debian-1.28.4
+ARG DOCKER_VERSION=20.10.24@sha256:2967f0819c84dd589ed0a023b9d25dcfe7a3c123d5bf784ffbb77edf55335f0c
+ARG DOCKER_COMPOSE_VERSION=debian-1.28.4@sha256:30ee50f1bde2414b58bc5f643a790a0ca07ce8cb533402d166511f5096b603d8
 ARG GOLANG_VERSION=1.15
-ARG GOLANGCI_LINT_VERSION=v1.42.1
+ARG GOLANGCI_LINT_VERSION=v1.64.8@sha256:2987913e27f4eca9c8a39129d2c7bc1e74fbcf77f181e01cea607be437aa5cb8
 
 FROM docker:${DOCKER_VERSION} AS docker-cli
 FROM docker/compose:${DOCKER_COMPOSE_VERSION} AS docker-compose
 FROM golangci/golangci-lint:${GOLANGCI_LINT_VERSION} as golangci-lint
 
-FROM golang:latest
+FROM golang:latest@sha256:f20d83a83e18dbd2a4714b8ffd4b30b287b6243962dd75608e86abcc63ba4efc
 
 # Configure to avoid build warnings and errors as described in official VSCode Remote-Containers extension documentation.
 # See https://code.visualstudio.com/docs/remote/containers-advanced#_reducing-dockerfile-build-warnings.

diff --git a/Dockerfiles/agent-ddot/Dockerfile.agent-otel b/Dockerfiles/agent-ddot/Dockerfile.agent-otel
@@ -1,7 +1,7 @@
 # check=skip=SecretsUsedInArgOrEnv
 ARG AGENT_DOCKER_REPO=datadog/agent
 ARG AGENT_VERSION=7.72.2
-ARG UBUNTU_VERSION=24.04
+ARG UBUNTU_VERSION=24.04@sha256:68ee22004a9109b44973313b02ff7b1de250f1de0f5ecb628d73f579aaff33ac
 ARG AGENT_DOCKER_TAG=${AGENT_VERSION}-full
 ARG AGENT_GIT_REF=${AGENT_VERSION}
 ARG BASE_IMAGE_REGISTRY=docker.io

diff --git a/Dockerfiles/agent/Dockerfile b/Dockerfiles/agent/Dockerfile
@@ -1,5 +1,5 @@
 ARG BASE_IMAGE_REGISTRY=registry.tooling.stackstate.io/docker/library
-ARG BASE_IMAGE_UBUNTU_VERSION=24.04
+ARG BASE_IMAGE_UBUNTU_VERSION=24.04@sha256:68ee22004a9109b44973313b02ff7b1de250f1de0f5ecb628d73f579aaff33ac
 ARG BCI_IMAGE_REGISTRY=registry.tooling.stackstate.io/suse/bci
 
 ##########################################
@@ -28,15 +28,15 @@ RUN dpkg -x /stackstate-agent*_${ARCH}.deb . \
 #   - copy default config files
 COPY stackstate*.yaml etc/stackstate-agent/
 
-FROM ${BCI_IMAGE_REGISTRY}/bci-base:15.7 AS software
+FROM ${BCI_IMAGE_REGISTRY}/bci-base:15.7@sha256:927140d8ede708eed63e8ce3c789801288403c23ac53a40ced59164abc938103 AS software
 # as per comment here: https://github.com/rancher/rancher/blob/main/package/Dockerfile#L12
 # No-op command to create an explicit layer - this fixes a weird buildkit/buildx bug on macos arm
 RUN :
 ####################################
 # Actual docker image construction #
 ####################################
 
-FROM ${BCI_IMAGE_REGISTRY}/bci-micro:15.7
+FROM ${BCI_IMAGE_REGISTRY}/bci-micro:15.7@sha256:f1427da6f40791aa5a9f73bb339674970ea93a2b158adc81bc99bcd1b7899a74
 LABEL maintainer="StackState <info@stackstate.com>"
 # Install system packages using builder image that has zypper
 

diff --git a/Dockerfiles/agent/windows/amd64/Dockerfile b/Dockerfiles/agent/windows/amd64/Dockerfile
@@ -1,4 +1,4 @@
-ARG BASE_IMAGE=mcr.microsoft.com/powershell:lts-windowsservercore-1809
+ARG BASE_IMAGE=mcr.microsoft.com/powershell:lts-windowsservercore-1809@sha256:cc2aebf0b8986f5c7cc10537072904da14cdcba7ad2cac227519849dc75d25c7
 FROM ${BASE_IMAGE}
 ARG BASE_IMAGE
 ARG BASE_IMAGE_OS="windows server core"

diff --git a/Dockerfiles/base-image/Dockerfile b/Dockerfiles/base-image/Dockerfile
@@ -1,4 +1,4 @@
-ARG BASE_IMAGE_UBUNTU_VERSION=24.04
+ARG BASE_IMAGE_UBUNTU_VERSION=24.04@sha256:68ee22004a9109b44973313b02ff7b1de250f1de0f5ecb628d73f579aaff33ac
 ARG BASE_IMAGE_UBUNTU_NAME=noble
 ARG BASE_IMAGE_REGISTRY=docker.io
 

diff --git a/Dockerfiles/cluster-agent/Dockerfile b/Dockerfiles/cluster-agent/Dockerfile
@@ -5,7 +5,7 @@ ARG BCI_IMAGE_REGISTRY=registry.tooling.stackstate.io/suse/bci
 # Preparation stage: layout and chmods #
 ########################################
 
-FROM ${BASE_IMAGE_REGISTRY}/ubuntu:20.04 as builder
+FROM ${BASE_IMAGE_REGISTRY}/ubuntu:20.04@sha256:8feb4d8ca5354def3d8fce243717141ce31e2c428701f6682bd2fafe15388214 as builder
 
 WORKDIR /output
 
@@ -25,12 +25,12 @@ RUN chmod 755 entrypoint.sh \
 # Actual docker image construction #
 ####################################
 
-FROM ${BCI_IMAGE_REGISTRY}/bci-base:15.7 AS software
+FROM ${BCI_IMAGE_REGISTRY}/bci-base:15.7@sha256:927140d8ede708eed63e8ce3c789801288403c23ac53a40ced59164abc938103 AS software
 # as per comment here: https://github.com/rancher/rancher/blob/main/package/Dockerfile#L12
 # No-op command to create an explicit layer - this fixes a weird buildkit/buildx bug on macos arm
 RUN :
 
-FROM ${BCI_IMAGE_REGISTRY}/bci-micro:15.7 AS final
+FROM ${BCI_IMAGE_REGISTRY}/bci-micro:15.7@sha256:f1427da6f40791aa5a9f73bb339674970ea93a2b158adc81bc99bcd1b7899a74 AS final
 LABEL maintainer="StackState <info@stackstate.com>"
 
 ARG user="stackstate-agent"

diff --git a/Dockerfiles/ddot-ebpf/Dockerfile b/Dockerfiles/ddot-ebpf/Dockerfile
@@ -1,4 +1,4 @@
-ARG BASE_IMAGE_UBUNTU_VERSION=24.04
+ARG BASE_IMAGE_UBUNTU_VERSION=24.04@sha256:68ee22004a9109b44973313b02ff7b1de250f1de0f5ecb628d73f579aaff33ac
 ARG BASE_IMAGE_UBUNTU_NAME=noble
 ARG BASE_IMAGE_REGISTRY=docker.io
 ARG AGENT_BASE_IMAGE_TAG

diff --git a/Dockerfiles/dogstatsd/alpine/Dockerfile b/Dockerfiles/dogstatsd/alpine/Dockerfile
@@ -1,4 +1,4 @@
-ARG BASE_IMAGE_ALPINE_VERSION=3.23.3
+ARG BASE_IMAGE_ALPINE_VERSION=3.24.3@sha256:be2656061b536c1883c4034790e21d0a09c5aaaf51968b89368a3c0371ea2c9a
 ARG BASE_IMAGE_REGISTRY=public.ecr.aws/docker
 
 FROM ${BASE_IMAGE_REGISTRY}/library/alpine:$BASE_IMAGE_ALPINE_VERSION AS release-base

diff --git a/Dockerfiles/local_builder/Dockerfile b/Dockerfiles/local_builder/Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.tooling.stackstate.io/quay/stackstate/stackstate-agent-runner-gitlab:debian-20220826-patched-20230511
+FROM registry.tooling.stackstate.io/quay/stackstate/stackstate-agent-runner-gitlab:debian-20220826-patched-20230511@sha256:447fceec0c84a113338551192030b812e392a5abde2032b24b0f81dc27398e89
 
 ARG UID
 ARG GID

diff --git a/Dockerfiles/otel-agent/Dockerfile b/Dockerfiles/otel-agent/Dockerfile
@@ -1,4 +1,4 @@
-ARG BASE_IMAGE_UBUNTU_VERSION=24.04
+ARG BASE_IMAGE_UBUNTU_VERSION=24.04@sha256:68ee22004a9109b44973313b02ff7b1de250f1de0f5ecb628d73f579aaff33ac
 ARG BASE_IMAGE_UBUNTU_NAME=noble
 ARG BASE_IMAGE_REGISTRY=docker.io
 ARG AGENT_BASE_IMAGE_TAG

diff --git a/tools/host-profiler/Dockerfile b/tools/host-profiler/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.26.10-trixie
+FROM golang:1.27.3-trixie@sha256:fbb7ae40b62ff8afe31662df570d39b4f5052ac32b90dae8e60d7657a20a74f4
 
 RUN cross_debian_arch=$(uname -m | sed -e 's/aarch64/amd64/'  -e 's/x86_64/arm64/'); \
     cross_pkg_arch=$(uname -m | sed -e 's/aarch64/x86-64/' -e 's/x86_64/aarch64/'); \