#203: pin all third-party deploy images by digest #262

fable-5 · 2026-07-31T05:13:26+02:00

fable-5 commented

2026-07-31 05:13:26 +02:00

Issue #203 (ADR 0024) — the last open M25 issue.

postgres:17.5-alpine, pandoc/core:3.6, gotenberg/gotenberg:8 (previously a floating MAJOR tag) and caddy:2.10-alpine are now name:tag@sha256 pins in deploy/compose/docker-compose.yml. The digests are exactly what the stages already run — verified against the live containers' RepoDigests on ONE — so the next recreation is byte-identical.
New early CI step fails on any third-party compose image reference without a digest (positive+negative case tested). compose.dev.yml is a local convenience, deliberately exempt; its node helper images now follow the #236 pin (22.15.1).
Update procedure documented in deploy/stages.md §5a (docker buildx imagetools inspect → digest; verification via docker inspect after rollout); #229 note follows after merge.
Rollout to the stage composes on ONE (test/int/prod — CD does not sync them) follows right after the merge as part of this issue's DoD; prod compose edit is file-only until the next release deploy.

Issue #203 (ADR 0024) — the last open M25 issue. - postgres:17.5-alpine, pandoc/core:3.6, gotenberg/gotenberg:8 (previously a floating MAJOR tag) and caddy:2.10-alpine are now `name:tag@sha256` pins in deploy/compose/docker-compose.yml. The digests are exactly what the stages already run — verified against the live containers' RepoDigests on ONE — so the next recreation is byte-identical. - New early CI step fails on any third-party compose image reference without a digest (positive+negative case tested). compose.dev.yml is a local convenience, deliberately exempt; its node helper images now follow the #236 pin (22.15.1). - Update procedure documented in deploy/stages.md §5a (docker buildx imagetools inspect → digest; verification via docker inspect after rollout); #229 note follows after merge. - Rollout to the stage composes on ONE (test/int/prod — CD does not sync them) follows right after the merge as part of this issue's DoD; prod compose edit is file-only until the next release deploy.

fable-5 added 1 commit 2026-07-31 05:13:26 +02:00

#203 : pin all third-party deploy images by digest

CI / Lint, typecheck, test (pull_request) Successful in 5m32s

Details

CI / Build container images (pull_request) Successful in 1m13s

Details

CI / Auth e2e pack (pull_request) Successful in 8m22s

Details

CI / Import/export fidelity gate (pull_request) Successful in 57s

Details

CD / Build and push images (push) Successful in 16s

Details

CD / Deploy to Test (push) Successful in 56s

Details

CD / Smoke tests against Test (push) Successful in 1m24s

Details

CD / Promote to Int (push) Successful in 52s

Details

CI / Lint, typecheck, test (push) Successful in 5m36s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Successful in 8m3s

Details

CI / Import/export fidelity gate (push) Successful in 57s

Details

db4f517e44

The four third-party images in the deploy compose (postgres, pandoc,
gotenberg — previously a floating MAJOR tag —, caddy) are now
name:tag@sha256 pins; the tag stays for readability, the digest decides
what runs. The pinned digests are exactly what the stages already run
(verified against the live containers' RepoDigests on ONE), so the next
recreation is byte-identical. A new early CI step fails on any
third-party compose image without a digest; compose.dev.yml is a local
convenience and deliberately exempt (its node helpers now follow the
#236 pin). Update + rollout procedure in deploy/stages.md — CD does not
sync stage composes, so the hand rollout to test/int/prod is part of
this issue's definition of done.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

fable-5 merged commit db4f517e44 into main

2026-07-31 05:28:56 +02:00

fable-5 referenced this pull request

2026-07-31 05:29:14 +02:00

[VS-NfD] Pin all container images by digest #203

fable-5 referenced this pull request

2026-07-31 05:29:14 +02:00

[VS-NfD] Write the operations manual (installation, update, backup/restore, deletion, role separation) #229

Sign in to join this conversation.

No reviewers