diff --git a/Dockerfile b/Dockerfile index 914e077..227b262 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,16 +5,17 @@ # Note: This is a PUBLIC image, it should not contain any sensitive data. # # Build targets: -# - slim: basic tools + security hardening (published as scalr/runner:-slim) -# - full: slim + Python + cloud CLIs + hardening (published as scalr/runner: +# - base: basic tools only (internal stage, not published) +# - slim: base + security hardening (published as scalr/runner:-slim) +# - full: base + Python + cloud CLIs + hardening (published as scalr/runner: # and scalr/runner:-python39) # -# UBUNTU_BASE_IMAGE, UBUNTU_BASE_DIGEST and other ARGs are supplied at build +# DEBIAN_BASE_IMAGE, DEBIAN_BASE_DIGEST and other ARGs are supplied at build # time via bake (see docker-bake.hcl + versions.json). The skip directive # above silences BuildKit's check for ARGs in FROM without a default. -ARG UBUNTU_BASE_IMAGE -ARG UBUNTU_BASE_DIGEST +ARG DEBIAN_BASE_IMAGE +ARG DEBIAN_BASE_DIGEST # Custom git-lfs build, we rely on Wolfi's approach from # https://github.com/wolfi-dev/os/blob/main/git-lfs.yaml @@ -37,7 +38,7 @@ RUN </dev/null || true - # Remove unnecesary files for final build - rm -rf \ - /usr/bin/pebble EOT -FROM scratch AS slim - -COPY --from=base-slim / / - ENTRYPOINT ["/usr/bin/bash"] + # ---------------------------------------------------------------------------- # full: base + Python + cloud CLIs + hardening (final image) # ---------------------------------------------------------------------------- -FROM slim AS full - -SHELL ["/bin/bash", "-o", "pipefail", "-euxc"] - -ARG TARGETARCH +FROM base AS full # Install python standalone build. ARG PYTHON_VERSION @@ -277,5 +271,4 @@ RUN </dev/null || true EOT - ENTRYPOINT ["/usr/bin/bash"] diff --git a/README.md b/README.md index 12206d9..fe6a255 100644 --- a/README.md +++ b/README.md @@ -67,10 +67,10 @@ versions below are the current pins (kept in sync with `versions.json` by * **Programming language** * Python ([v3.14.6](https://www.python.org/downloads/release/python-3146/)) — [standalone CPython build](https://github.com/astral-sh/python-build-standalone) from [astral.sh](https://astral.sh/) * **Cloud CLIs** - * AWS CLI ([2.35.13](https://github.com/aws/aws-cli/releases/tag/2.35.13)) — Amazon Web Services CLI + * AWS CLI ([2.35.22](https://github.com/aws/aws-cli/releases/tag/2.35.22)) — Amazon Web Services CLI * AWS Session Manager Plugin — SSM session support for the AWS CLI - * Azure CLI ([2.87.0](https://github.com/Azure/azure-cli/releases/tag/azure-cli-2.87.0)) — Microsoft Azure CLI - * Google Cloud SDK ([575.0.0](https://cloud.google.com/sdk/docs/release-notes#57500)) — `gcloud` with `alpha`, `beta`, and `gke-gcloud-auth-plugin` components + * Azure CLI ([2.88.0](https://github.com/Azure/azure-cli/releases/tag/azure-cli-2.88.0)) — Microsoft Azure CLI + * Google Cloud SDK ([575.0.1](https://cloud.google.com/sdk/docs/release-notes#57501)) — `gcloud` with `alpha`, `beta`, and `gke-gcloud-auth-plugin` components * Kubectl ([0.36.2](https://github.com/kubernetes/kubectl/releases/tag/v0.36.2)) — Kubernetes CLI * Scalr CLI ([0.18.0](https://github.com/Scalr/scalr-cli/releases/tag/v0.18.0)) — command-line client for the Scalr API diff --git a/bump-versions.py b/bump-versions.py index 23265d7..3ab7eb7 100755 --- a/bump-versions.py +++ b/bump-versions.py @@ -225,8 +225,8 @@ def _latest_python_version(series: str) -> tuple[str, str]: return "", "" -def get_ubuntu_base_digest(image_ref: str) -> str: - """Resolve a Docker Hub image reference (e.g. "ubuntu:26.04") to +def get_debian_base_digest(image_ref: str) -> str: + """Resolve a Docker Hub image reference (e.g. "debian:trixie-slim") to its current manifest digest. Uses Docker Hub's anonymous v2 registry API. """ name, _, tag = image_ref.partition(":") @@ -385,18 +385,18 @@ def main() -> int: base = read_versions(SECTION_BASE) changes: list[tuple[str, str, str]] = [] - # UBUNTU_BASE_IMAGE is read-only here — the base image (e.g. ubuntu:26.04) + # DEBIAN_BASE_IMAGE is read-only here — the base image (e.g. debian:trixie-slim) # is a deliberate human choice and must not be auto-bumped. We only refresh the # digest pinning for whatever image is currently configured. - ubuntu_image = base.get("UBUNTU_BASE_IMAGE", "") - if not ubuntu_image: - log.error(f"UBUNTU_BASE_IMAGE missing from {VERSIONS_FILE} ({SECTION_BASE})") + debian_image = base.get("DEBIAN_BASE_IMAGE", "") + if not debian_image: + log.error(f"DEBIAN_BASE_IMAGE missing from {VERSIONS_FILE} ({SECTION_BASE})") return 1 bump( - "ubuntu_base_digest", - "UBUNTU_BASE_DIGEST", - get_ubuntu_base_digest(ubuntu_image), - base.get("UBUNTU_BASE_DIGEST", ""), + "debian_base_digest", + "DEBIAN_BASE_DIGEST", + get_debian_base_digest(debian_image), + base.get("DEBIAN_BASE_DIGEST", ""), changes, section=SECTION_BASE, ) diff --git a/versions.json b/versions.json index 06f23ab..a101e5f 100644 --- a/versions.json +++ b/versions.json @@ -2,8 +2,8 @@ "variable": { "versions_base": { "default": { - "UBUNTU_BASE_IMAGE": "ubuntu:26.04", - "UBUNTU_BASE_DIGEST": "sha256:53958ec7b67c2c9355df922dd08dbf0360611f8c3cdb656875e81873db9ffdba" + "DEBIAN_BASE_IMAGE": "debian:trixie-slim", + "DEBIAN_BASE_DIGEST": "sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd" } }, "versions_full": { @@ -11,13 +11,13 @@ "KUBECTL_VERSION": "v1.36.2", "KUBECTL_SHA256_AMD64": "1e9045ec32bea85da43de85f0065358529ea7c7a152eca78154fba5b58c27d82", "KUBECTL_SHA256_ARM64": "c957eb8c4bea27a3bb35b269edd9082e27f027f7b76b20b5bf4afebc726c6d3e", - "GCLOUD_VERSION": "575.0.0", - "GCLOUD_SHA256_AMD64": "92a7331b6b20c9869c5e234f15e44850a58af435ccab43578d4ede1ef368a6e6", - "GCLOUD_SHA256_ARM64": "54b607d35b7335297e5e4166b3f9137baa5b1a7c7d2f8ce396411e91bd1fd4df", - "AWS_CLI_VERSION": "2.35.13", - "AWS_CLI_SHA256_AMD64": "9d8358b854dfac0decde81a0a21471abb5fd52d7366533bf25affcbbc2d5ad90", - "AWS_CLI_SHA256_ARM64": "c562b596fa9711f340c82307ca9eff576a4b96e75f1a003d1e6b2fec77820883", - "AZURE_CLI_VERSION": "2.87.0", + "GCLOUD_VERSION": "575.0.1", + "GCLOUD_SHA256_AMD64": "7027aef2f0d72c147da6b2263cf77a4a4c659afe28aeca51a45134249997e2c3", + "GCLOUD_SHA256_ARM64": "1330c1303767dd15f56c50ff4ef5d6f0900ff46f139b46cfef72b93580102029", + "AWS_CLI_VERSION": "2.35.22", + "AWS_CLI_SHA256_AMD64": "edd9ba798acb3ef6131e5bf902d81999ebc8ad72fbec8771d690f3ed0c059110", + "AWS_CLI_SHA256_ARM64": "022e392e079ada523be29cdbb45061a74be6344179f8fddf2b8183f1898683f1", + "AZURE_CLI_VERSION": "2.88.0", "SCALR_CLI_VERSION": "0.18.0", "SCALR_CLI_SHA256_AMD64": "5321bcebd48d30f7c3a936a5c5f10d9d3cfb77ef2974575d4df8e7ee9f890589", "SCALR_CLI_SHA256_ARM64": "8dcada09b5bf10001f4e83190fc9c2a66df692beb07a74b4afe503d2fa75629e",