Scalr · mermoldy · May 25, 2026 · May 12, 2026 · May 13, 2026 · May 13, 2026
diff --git a/.dockerignore b/.dockerignore
@@ -0,0 +1,6 @@
+# Default-deny: ignore everything, then re-include only what the build needs.
+# The Dockerfile currently uses no COPY/ADD, so the build context can be empty.
+*
+
+# Keep Dockerfile itself accessible to buildx.
+!Dockerfile
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -29,28 +29,26 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Read Versions
-        id: versions
+      - name: Prepare build args
+        id: args
         run: |
-          echo "kubectl=$(grep '^kubectl=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "gcloud=$(grep '^gcloud=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "aws_cli=$(grep '^aws_cli=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "azure_cli=$(grep '^azure_cli=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "scalr_cli=$(grep '^scalr_cli=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "python=$(grep '^python=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "python_release=$(grep '^python_release=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
+          {
+            echo 'default<<EOF'
+            grep -E '^[A-Z]' versions
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+          # Override block for the python39 variant — appended after defaults
+          # in the build-args input; later entries win in buildx.
+          {
+            echo 'python39<<EOF'
+            grep -E '^[A-Z]' versions_python39
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
 
       - name: Build Docker image
         uses: docker/build-push-action@v6
         with:
-          build-args: |
-            KUBECTL_VERSION=${{ steps.versions.outputs.kubectl }}
-            GCLOUD_VERSION=${{ steps.versions.outputs.gcloud }}
-            AWS_CLI_VERSION=${{ steps.versions.outputs.aws_cli }}
-            AZURE_CLI_VERSION=${{ steps.versions.outputs.azure_cli }}
-            SCALR_CLI_VERSION=${{ steps.versions.outputs.scalr_cli }}
-            PYTHON_VERSION=${{ steps.versions.outputs.python }}
-            PYTHON_RELEASE=${{ steps.versions.outputs.python_release }}
+          build-args: ${{ steps.args.outputs.default }}
           cache-from: type=registry,ref=scalr/runner:buildcache
           cache-to: type=registry,ref=scalr/runner:buildcache
           load: true
@@ -72,13 +70,8 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           build-args: |
-            KUBECTL_VERSION=${{ steps.versions.outputs.kubectl }}
-            GCLOUD_VERSION=${{ steps.versions.outputs.gcloud }}
-            AWS_CLI_VERSION=${{ steps.versions.outputs.aws_cli }}
-            AZURE_CLI_VERSION=${{ steps.versions.outputs.azure_cli }}
-            SCALR_CLI_VERSION=${{ steps.versions.outputs.scalr_cli }}
-            PYTHON_VERSION=3.9.25
-            PYTHON_RELEASE=20251031
+            ${{ steps.args.outputs.default }}
+            ${{ steps.args.outputs.python39 }}
           cache-from: type=registry,ref=scalr/runner:buildcache-python39
           cache-to: type=registry,ref=scalr/runner:buildcache-python39
           load: true

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -25,16 +25,21 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Read Versions
-        id: versions
+      - name: Prepare build args
+        id: args
         run: |
-          echo "kubectl=$(grep '^kubectl=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "gcloud=$(grep '^gcloud=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "aws_cli=$(grep '^aws_cli=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "azure_cli=$(grep '^azure_cli=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "scalr_cli=$(grep '^scalr_cli=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "python=$(grep '^python=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
-          echo "python_release=$(grep '^python_release=' versions | cut -d= -f2)" | tee -a $GITHUB_OUTPUT
+          {
+            echo 'default<<EOF'
+            grep -E '^[A-Z]' versions
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+          # Override block for the python39 variant — appended after defaults
+          # in the build-args input; later entries win in buildx.
+          {
+            echo 'python39<<EOF'
+            grep -E '^[A-Z]' versions_python39
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
 
       - name: Format Image Tag
         id: image_tag
@@ -44,14 +49,7 @@ jobs:
       - name: Build Docker image
         uses: docker/build-push-action@v6
         with:
-          build-args: |
-            KUBECTL_VERSION=${{ steps.versions.outputs.kubectl }}
-            GCLOUD_VERSION=${{ steps.versions.outputs.gcloud }}
-            AWS_CLI_VERSION=${{ steps.versions.outputs.aws_cli }}
-            AZURE_CLI_VERSION=${{ steps.versions.outputs.azure_cli }}
-            SCALR_CLI_VERSION=${{ steps.versions.outputs.scalr_cli }}
-            PYTHON_VERSION=${{ steps.versions.outputs.python }}
-            PYTHON_RELEASE=${{ steps.versions.outputs.python_release }}
+          build-args: ${{ steps.args.outputs.default }}
           platforms: linux/amd64,linux/arm64
           cache-from: type=registry,ref=scalr/runner:buildcache
           cache-to: type=registry,ref=scalr/runner:buildcache
@@ -64,13 +62,8 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           build-args: |
-            KUBECTL_VERSION=${{ steps.versions.outputs.kubectl }}
-            GCLOUD_VERSION=${{ steps.versions.outputs.gcloud }}
-            AWS_CLI_VERSION=${{ steps.versions.outputs.aws_cli }}
-            AZURE_CLI_VERSION=${{ steps.versions.outputs.azure_cli }}
-            SCALR_CLI_VERSION=${{ steps.versions.outputs.scalr_cli }}
-            PYTHON_VERSION=3.9.25
-            PYTHON_RELEASE=20251031
+            ${{ steps.args.outputs.default }}
+            ${{ steps.args.outputs.python39 }}
           platforms: linux/amd64,linux/arm64
           cache-from: type=registry,ref=scalr/runner:buildcache-python39
           cache-to: type=registry,ref=scalr/runner:buildcache-python39

diff --git a/Dockerfile b/Dockerfile
@@ -3,7 +3,8 @@
 #
 # Note: This is a PUBLIC image, it should not contain any sensitive data.
 
-FROM debian:trixie-slim
+ARG DEBIAN_BASE_DIGEST
+FROM debian:trixie-slim@${DEBIAN_BASE_DIGEST}
 
 ARG TARGETARCH
 
@@ -20,11 +21,7 @@
     gnupg \
     zip unzip \
     lsb-release
-  [ "${TARGETARCH}" = "amd64" ] && SESSION_MANAGER_ARCH="64bit" || SESSION_MANAGER_ARCH="arm64"
-  curl "https://s3.amazonaws.com/session-manager-downloads/plugin/latest/ubuntu_${SESSION_MANAGER_ARCH}/session-manager-plugin.deb" -o "session-manager-plugin.deb"
-  dpkg -i session-manager-plugin.deb
   # Cleanup
-  rm session-manager-plugin.deb
   apt-get clean
   apt-get autoremove -y
   rm -rf /var/lib/apt/lists/*
@@ -34,20 +31,23 @@
 # Install python standalone build.
 ARG PYTHON_VERSION
 ARG PYTHON_RELEASE
+ARG PYTHON_SHA256_AMD64
+ARG PYTHON_SHA256_ARM64
 LABEL python.version=${PYTHON_VERSION}
 ENV PIP_ROOT_USER_ACTION=ignore
 
 RUN <<EOT
   # See: https://gregoryszorc.com/docs/python-build-standalone/main/running.html#extracting-distributions
   export VERSION="${PYTHON_VERSION}"
   export RELEASE="${PYTHON_RELEASE}"
-  # Extract major.minor version (e.g., 3.13 from 3.13.11)
+  # Extract major.minor version (e.g., 3.x from 3.x.y)
   export PY_MINOR="${VERSION%.*}"
   apt-get update -y
   apt-get install -y --no-install-recommends zstd binutils
-  [ "${TARGETARCH}" = "amd64" ] && export OPTIONS="x86_64-unknown-linux-gnu-pgo+lto-full"
-  [ "${TARGETARCH}" = "arm64" ] && export OPTIONS="aarch64-unknown-linux-gnu-pgo+lto-full"
-  curl -L -o python.tar.zst "https://github.com/astral-sh/python-build-standalone/releases/download/${RELEASE}/cpython-${VERSION}+${RELEASE}-${OPTIONS}.tar.zst"
+  [ "${TARGETARCH}" = "amd64" ] && export OPTIONS="x86_64-unknown-linux-gnu-pgo+lto-full" PY_SHA256="${PYTHON_SHA256_AMD64}"
+  [ "${TARGETARCH}" = "arm64" ] && export OPTIONS="aarch64-unknown-linux-gnu-pgo+lto-full" PY_SHA256="${PYTHON_SHA256_ARM64}"
+  curl -fsSL -o python.tar.zst "https://github.com/astral-sh/python-build-standalone/releases/download/${RELEASE}/cpython-${VERSION}+${RELEASE}-${OPTIONS}.tar.zst"
+  echo "${PY_SHA256}  python.tar.zst" | sha256sum -c -
   tar --zstd -xf python.tar.zst
   cp -rp python/install/* /usr
   rm python.tar.zst
@@ -71,21 +71,28 @@
 
 # Kubectl
 ARG KUBECTL_VERSION
+ARG KUBECTL_SHA256_AMD64
+ARG KUBECTL_SHA256_ARM64
 LABEL kubectl.version=${KUBECTL_VERSION}
 RUN <<EOT
-  curl -L -o /usr/local/bin/kubectl "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl"
+  [ "${TARGETARCH}" = "amd64" ] && KUBECTL_SHA256="${KUBECTL_SHA256_AMD64}" || KUBECTL_SHA256="${KUBECTL_SHA256_ARM64}"
+  curl -fsSL -o /usr/local/bin/kubectl "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl"
+  echo "${KUBECTL_SHA256}  /usr/local/bin/kubectl" | sha256sum -c -
   chmod a+x /usr/local/bin/kubectl
 EOT
 
 # GCloud
 ARG GCLOUD_VERSION
+ARG GCLOUD_SHA256_AMD64
+ARG GCLOUD_SHA256_ARM64
 LABEL gcloud.version=${GCLOUD_VERSION}
 # Our terraform runs are running in terraform container, where home dir (HOME env var) is /tmp,
 # therefore all pip binaries are installing under /tmp/.local/bin
 ENV PATH=/usr/local/google-cloud-sdk/bin:/tmp/.local/bin:$PATH
 RUN <<EOT
-  [ "${TARGETARCH}" = "amd64" ] && GCLOUD_ARCH="x86_64" || GCLOUD_ARCH="arm"
+  [ "${TARGETARCH}" = "amd64" ] && GCLOUD_ARCH="x86_64" GCLOUD_SHA256="${GCLOUD_SHA256_AMD64}" || GCLOUD_ARCH="arm" GCLOUD_SHA256="${GCLOUD_SHA256_ARM64}"
   curl -fsSL "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-${GCLOUD_VERSION}-linux-${GCLOUD_ARCH}.tar.gz" -o google-cloud-sdk.tar.gz
+  echo "${GCLOUD_SHA256}  google-cloud-sdk.tar.gz" | sha256sum -c -
   tar -C /usr/local -zxf google-cloud-sdk.tar.gz
   rm -rf google-cloud-sdk.tar.gz
   gcloud components install \
@@ -98,16 +105,33 @@
 
 # AWS CLI
 ARG AWS_CLI_VERSION
+ARG AWS_CLI_SHA256_AMD64
+ARG AWS_CLI_SHA256_ARM64
 LABEL aws-cli.version=${AWS_CLI_VERSION}
 RUN <<EOT
-  [ "${TARGETARCH}" = "amd64" ] && AWS_CLI_ARCH="x86_64" || AWS_CLI_ARCH="aarch64"
+  [ "${TARGETARCH}" = "amd64" ] && AWS_CLI_ARCH="x86_64" AWS_CLI_SHA256="${AWS_CLI_SHA256_AMD64}" || AWS_CLI_ARCH="aarch64" AWS_CLI_SHA256="${AWS_CLI_SHA256_ARM64}"
   curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-${AWS_CLI_ARCH}-${AWS_CLI_VERSION}.zip" -o awscli.zip
+  echo "${AWS_CLI_SHA256}  awscli.zip" | sha256sum -c -
   unzip -q awscli.zip
   ./aws/install
   # Cleanup
   rm -rf aws awscli.zip
 EOT
 
+# AWS Session Manager Plugin
+ARG AWS_SSM_PLUGIN_VERSION
+ARG AWS_SSM_PLUGIN_SHA256_AMD64
+ARG AWS_SSM_PLUGIN_SHA256_ARM64
+LABEL aws-ssm-plugin.version=${AWS_SSM_PLUGIN_VERSION}
+RUN <<EOT
+  [ "${TARGETARCH}" = "amd64" ] && SSM_ARCH="64bit" SSM_SHA256="${AWS_SSM_PLUGIN_SHA256_AMD64}" || SSM_ARCH="arm64" SSM_SHA256="${AWS_SSM_PLUGIN_SHA256_ARM64}"
+  curl -fsSL -o session-manager-plugin.deb \
+    "https://s3.amazonaws.com/session-manager-downloads/plugin/${AWS_SSM_PLUGIN_VERSION}/ubuntu_${SSM_ARCH}/session-manager-plugin.deb"
+  echo "${SSM_SHA256}  session-manager-plugin.deb" | sha256sum -c -
+  dpkg -i session-manager-plugin.deb
+  rm session-manager-plugin.deb
+EOT
+
 # Azure CLI
 ARG AZURE_CLI_VERSION
 LABEL azure-cli.version=${AZURE_CLI_VERSION}
@@ -134,9 +158,13 @@
 
 # Scalr CLI
 ARG SCALR_CLI_VERSION
+ARG SCALR_CLI_SHA256_AMD64
+ARG SCALR_CLI_SHA256_ARM64
 LABEL scalr-cli.version=${SCALR_CLI_VERSION}
 RUN <<EOT
+  [ "${TARGETARCH}" = "amd64" ] && SCALR_CLI_SHA256="${SCALR_CLI_SHA256_AMD64}" || SCALR_CLI_SHA256="${SCALR_CLI_SHA256_ARM64}"
   curl -fsSL "https://github.com/Scalr/scalr-cli/releases/download/v${SCALR_CLI_VERSION}/scalr-cli_${SCALR_CLI_VERSION}_linux_${TARGETARCH}.zip" -o scalr_cli.zip
+  echo "${SCALR_CLI_SHA256}  scalr_cli.zip" | sha256sum -c -
   unzip -q scalr_cli.zip
   mv ./scalr /usr/local/bin/scalr
   # Cleanup
@@ -146,4 +174,27 @@
 # Add the scalr user (optional; used when running the container with UID 1000).
 RUN useradd -u 1000 -m scalr
 
+# Security hardening: strip privilege-escalation surface inherited from the base image.
+# Must run last so it cannot be undone by a later layer.
+RUN <<EOT
+  # Remove su/sudo and account/password/login management tools.
+  rm -f \
+    /bin/su /usr/bin/su \
+    /bin/sudo /usr/bin/sudo /usr/sbin/sudo \
+    /usr/bin/passwd /usr/sbin/chpasswd \
+    /usr/bin/chsh /usr/bin/chfn \
+    /usr/bin/newgrp /usr/bin/gpasswd \
+    /usr/bin/chage /usr/bin/expiry \
+    /usr/sbin/unix_chkpwd /usr/sbin/pam_timestamp_check \
+    /usr/sbin/useradd /usr/sbin/userdel /usr/sbin/usermod \
+    /usr/sbin/groupadd /usr/sbin/groupdel /usr/sbin/groupmod \
+    /usr/sbin/adduser /usr/sbin/addgroup \
+    /usr/sbin/deluser /usr/sbin/delgroup \
+    /usr/sbin/visudo \
+    /bin/mount /usr/bin/mount \
+    /bin/umount /usr/bin/umount
+  # Strip SUID/SGID bits from every remaining file (defense-in-depth).
+  find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -exec chmod a-s {} + 2>/dev/null || true
+EOT
+
 ENTRYPOINT ["/usr/bin/bash"]
diff --git a/README.md b/README.md
@@ -23,14 +23,14 @@ This environment comes pre-equipped with a comprehensive suite of tools essentia
   * wget - File downloads from the web
   * ca-certificates - Trusted CA certificates
 * **Programming Languages**
-  * Python ([v3.14.4](https://www.python.org/downloads/release/python-3144/)) - General-purpose programming language (release)
+  * Python ([v3.14.5](https://www.python.org/downloads/release/python-3145/)) - General-purpose programming language (release)
   * jq - Command-line JSON processor
 * **Cloud Clients**
-  * AWS CLI ([2.34.29](https://github.com/aws/aws-cli/releases/tag/2.34.29)) - Amazon Web Services CLI.
-  * Azure CLI ([2.85.0](https://github.com/Azure/azure-cli/releases/tag/azure-cli-2.85.0)) - Microsoft Azure CLI.
-  * Google Cloud SDK ([564.0.0](https://cloud.google.com/sdk/docs/release-notes#56400)) - Stable, Alpha, Beta components. Includes kubectl authenticator.
-  * Kubectl ([0.35.3](https://github.com/kubernetes/kubectl/releases/tag/v0.35.3)) - Kubernetes CLI.
-  * Scalr CLI ([0.17.8](https://github.com/Scalr/scalr-cli/releases/tag/v0.17.8)) - The command-line to communicate with the Scalr API.
+  * AWS CLI ([2.34.45](https://github.com/aws/aws-cli/releases/tag/2.34.45)) - Amazon Web Services CLI.
+  * Azure CLI ([2.86.0](https://github.com/Azure/azure-cli/releases/tag/azure-cli-2.86.0)) - Microsoft Azure CLI.
+  * Google Cloud SDK ([568.0.0](https://cloud.google.com/sdk/docs/release-notes#56800)) - Stable, Alpha, Beta components. Includes kubectl authenticator.
+  * Kubectl ([0.36.1](https://github.com/kubernetes/kubectl/releases/tag/v0.36.1)) - Kubernetes CLI.
+  * Scalr CLI ([0.18.0](https://github.com/Scalr/scalr-cli/releases/tag/v0.18.0)) - The command-line to communicate with the Scalr API.
 
 The versions for Python, Cloud Clients, Kubectl, and Scalr CLI are specifically pinned and detailed in the [versions](./versions) file. All other software included in this environment is sourced directly from the Debian Trixie upstream repositories.
 
@@ -47,30 +47,32 @@ Two Python variants are available:
 
 ## Runner Image Building
 
+All tool versions and SHA256 checksums are stored as `KEY=value` lines:
+
+- [`versions`](./versions) — defaults (kubectl, gcloud, AWS CLI, Azure CLI, Scalr CLI, Python 3.14, AWS SSM Plugin)
+- [`versions_python39`](./versions_python39) — Python 3.9 overrides (consumed only by the `-python39` image)
+
+The snippet below forwards every entry as a `--build-arg`, so each download is
+verified against a hash pinned in this repo.
+
+### Default image (Python 3.14)
+
 ```bash
 docker buildx build \
-  --build-arg PYTHON_VERSION=3.14.4 \
-  --build-arg PYTHON_RELEASE=20260408 \
-  --build-arg KUBECTL_VERSION=v1.35.3 \
-  --build-arg GCLOUD_VERSION=564.0.0 \
-  --build-arg AWS_CLI_VERSION=2.34.29 \
-  --build-arg AZURE_CLI_VERSION=2.85.0 \
-  --build-arg SCALR_CLI_VERSION=0.17.8 \
+  $(grep -v '^#' versions | grep -v '^$' | xargs -I {} echo --build-arg={}) \
   --platform linux/amd64 \
   -t scalr/runner:latest --load .
 ```
 
-To build the Python 3.9 variant:
+### Python 3.9 variant
+
+Pass both files; later args override earlier ones, so `versions_python39`
+replaces the `PYTHON_*` keys from `versions`:
 
 ```bash
 docker buildx build \
-  --build-arg PYTHON_VERSION=3.9.25 \
-  --build-arg PYTHON_RELEASE=20251031 \
-  --build-arg KUBECTL_VERSION=v1.35.3 \
-  --build-arg GCLOUD_VERSION=564.0.0 \
-  --build-arg AWS_CLI_VERSION=2.34.29 \
-  --build-arg AZURE_CLI_VERSION=2.85.0 \
-  --build-arg SCALR_CLI_VERSION=0.17.8 \
+  $(grep -v '^#' versions          | grep -v '^$' | xargs -I {} echo --build-arg={}) \
+  $(grep -v '^#' versions_python39 | grep -v '^$' | xargs -I {} echo --build-arg={}) \
   --platform linux/amd64 \
   -t scalr/runner:latest-python39 --load .
 ```
@@ -80,9 +82,17 @@ docker buildx build \
 To update all tool versions to their latest releases, run:
 
 ```bash
-./bump-versions.sh
+./bump-versions.py
 ```
 
-This script fetches the latest versions from upstream sources and updates the [versions](./versions) file and README.md.
+This script fetches the latest versions from upstream sources and updates the [versions](./versions) and [versions_python39](./versions_python39) files (plus the "Included Tools" section of this README). For every tool it also refreshes the per-arch SHA256 checksums used by the Dockerfile to verify each download.
 
-Requirements: `curl` and `jq`.
+Requirements: `python3` (stdlib only, no `pip install` needed).
+
+GitHub's anonymous API quota is 60 requests/hour. The script makes ~5 calls to
+`api.github.com` per run, so frequent reruns may hit `HTTP 403: rate limit exceeded`.
+Export `GITHUB_TOKEN` (or `GH_TOKEN`) to lift the limit to 5000/hour:
+
+```bash
+GITHUB_TOKEN=$(gh auth token) ./bump-versions.py
+```