atomist-skills / skill-base

Apache License 2.0
0 stars 0 forks source link

Re-pin Docker base image in Dockerfile #73

Closed atomist[bot] closed 2 years ago

atomist[bot] commented 2 years ago

This pull request re-pins the Docker base image alpine:3.15 in Dockerfile to the current digest.

https://github.com/atomist-skills/skill-base/blob/e1e88314aa963e5be5dd7a2dbaf3b3dcc9ed1af1/Dockerfile#L1-L1

Digest sha256:f22945d45ee2eb4dd463ed5a431d9f04fcd80ca768bb1acf898d91ce51f7bf04 references a multi-CPU architecture image manifest. This image supports the following architectures:

Changelog for alpine:3.15

### Commit New image build caused by commit docker-library/official-images@da160562115a8c00680f4fd9929aefc2cc4ff316 to [`library/alpine`](https://github.com/docker-library/official-images/blob/da160562115a8c00680f4fd9929aefc2cc4ff316/library/alpine): ``` alpine: bump edge snapshot 20220328 (CVE-2018-25032) ``` --- ### Comparison Comparing Docker image `alpine:3.15` at digests _Current_ `sha256:ceeae2849a425ef1a7e591d8288f1a58cdf1f4e8d9da7510e29ea829e61cf512` and _Proposed_ `sha256:f22945d45ee2eb4dd463ed5a431d9f04fcd80ca768bb1acf898d91ce51f7bf04` : #### Packages No package differences detected #### Files The following file modifications were detected: | Name | Current | Proposed | Diff | | ---- | ------- | -------- | ---- | | `/etc/alpine-release` | `7b` | `7b` | `0b` | | `/etc/os-release` | `164b` | `164b` | `0b` | | `/lib/apk/db/installed` | `14kb` | `14kb` | `0b` | | `/lib/libz.so.1` | `14b` | `14b` | `0b` | | `/lib/libz.so.1.2.11` | | `-` | `0b` | | `/lib/libz.so.1.2.12` | | `+` | `90kb` | #### History The following differences in [`docker history`](https://docs.docker.com/engine/reference/commandline/history/) were detected: ```diff -/bin/sh -c #(nop) ADD file:30da1868f9f0555fb3e5223cd75cbf3c31760c1b6087f42d78abb08a8c5066ff in / +/bin/sh -c #(nop) ADD file:24e8b04304ef91bbf949674909ccaf2c66e3dcd096c3c307a0510569eadf576f in / /bin/sh -c #(nop) CMD ["/bin/sh"] ``` #### Ports No different exposed ports detected #### Environment Variables No different environment variables detected


Pinning FROM lines to digests makes your builds repeatable. Atomist will raise new pull requests whenever the tag moves, so that you know when the base image has been updated. You can follow a new tag at any time. Just replace the digest with the new tag you want to follow. Atomist, will switch to following this new tag.


File changed: