use Dockerfile with sha-pinning

neondatabase · Feb 27, 2025 · ff7818b · ff7818b
1 parent 770258c
commit ff7818b
Showing 1 changed file with 11 additions and 2 deletions.
diff --git a/Dockerfiles/go-app-common.Dockerfile b/Dockerfiles/go-app-common.Dockerfile
@@ -1,6 +1,15 @@
-ARG BASE_IMAGE=debian:bookworm-slim
+ARG DEBIAN_VERSION=bookworm
+ARG DEBIAN_FLAVOR=${DEBIAN_VERSION}-slim
 
-FROM --platform=$TARGETPLATFORM ${BASE_IMAGE}
+ARG BOOKWORM_SLIM_SHA=sha256:40b107342c492725bc7aacbe93a49945445191ae364184a6d24fedb28172f6f7
+ARG BULLSEYE_SLIM_SHA=sha256:e831d9a884d63734fe3dd9c491ed9a5a3d4c6a6d32c5b14f2067357c49b0b7e1
+
+ARG BASE_IMAGE_SHA=debian:${DEBIAN_FLAVOR}
+ARG BASE_IMAGE_SHA=${BASE_IMAGE_SHA/debian:bookworm-slim/debian@$BOOKWORM_SLIM_SHA}
+ARG BASE_IMAGE_SHA=${BASE_IMAGE_SHA/debian:bullseye-slim/debian@$BULLSEYE_SLIM_SHA}
+
+
+FROM --platform=$TARGETPLATFORM ${BASE_IMAGE_SHA}
 ARG BINARY_TO_ADD
 
 ADD ${BINARY_TO_ADD} /usr/local/bin/