Update docker/dockerfile Docker tag to v1.26.0 (from 1.19.0) - #36
Update docker/dockerfile Docker tag to v1.26.0 (from 1.19.0)#36Erwan-loot wants to merge 1 commit into
Conversation
425b984 to
a6e4e8c
Compare
Erwan-loot
changed the title
a6e4e8c to
d13ecb4
Compare
Erwan-loot
changed the title
d13ecb4 to
f3646b0
Compare
Erwan-loot
changed the title
There was a problem hiding this comment.
Pull request overview
Updates the Dockerfile frontend syntax image pin used by BuildKit when parsing this repository’s Dockerfile, ensuring builds use a newer docker/dockerfile frontend.
Changes:
- Bump
# syntax=docker/dockerfileversion and digest pin inDockerfile.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -1,4 +1,4 @@ | |||
| # syntax=docker/dockerfile:1.19.0@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6 | |||
| # syntax=docker/dockerfile:1.23.0@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769 | |||
There was a problem hiding this comment.
PR metadata says this update is to docker/dockerfile v1.22.0, but the Dockerfile syntax directive is updated to v1.23.0. Please align the PR title/description with the actual change (or update the directive to the intended version) to avoid confusion when auditing dependency updates.
f3646b0 to
85a52f9
Compare
Erwan-loot
changed the title
85a52f9 to
bd29a22
Compare
Erwan-loot
changed the title
📝 WalkthroughWalkthroughThe Dockerfile syntax directive is updated from ChangesDockerfile Frontend Version Bump
Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
bd29a22 to
bcd857c
Compare
Erwan-loot
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 1: Set the final Dockerfile runtime user to warracker by adding USER
warracker after the runtime setup and before any remaining CMD or ENTRYPOINT
instructions, ensuring the container does not run as root.
- Line 1: Update the Dockerfile syntax directive to use the intended
docker/dockerfile:1.25.0 tag and replace its digest with the exact manifest
digest for that tag, keeping the immutable tag-and-digest pin consistent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,4 +1,4 @@ | |||
| # syntax=docker/dockerfile:1.19.0@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6 | |||
| # syntax=docker/dockerfile:1.26.0@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n '^\s*(FROM|USER)\b' DockerfileRepository: Erwan-loot/Warracker
Length of output: 388
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo '--- Dockerfile relevant section ---'
sed -n '1,120p' Dockerfile
echo
echo '--- Dockerfiles matching FROM/USER outside of syntax/header comments ---'
rg -n '^\s*(FROM|USER)\b' DockerfileRepository: Erwan-loot/Warracker
Length of output: 5072
Set the final Dockerfile USER to the non-root user.
The runtime stage creates warracker, but the Dockerfile does not switch to it. Add USER warracker before any remaining CMD/ENTRYPOINT instructions so Docker does not run the final container as root.
🧰 Tools
🪛 Trivy (0.72.0)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 1, Set the final Dockerfile runtime user to warracker by
adding USER warracker after the runtime setup and before any remaining CMD or
ENTRYPOINT instructions, ensuring the container does not run as root.
Source: Linters/SAST tools
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
docker buildx imagetools inspect docker/dockerfile:1.25.0
docker buildx imagetools inspect docker/dockerfile:1.25.0@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32Repository: Erwan-loot/Warracker
Length of output: 202
🌐 Web query:
Docker Hub docker/dockerfile 1.25.0 tag digest docker/dockerfile:1.26.0 stable labs
💡 Result:
The docker/dockerfile image repository maintains two distinct release channels: stable and labs [1]. Regarding your specific version queries: 1.25.0 Digest The docker/dockerfile:1.25.0 image is a stable release [2][3]. As a multi-architecture image, its digest depends on the specific platform (OS/architecture). For example, common digests include: - linux/amd64: sha256:3d6d54b33351b396a910d33248754b86b1d7dd838b4eeb9575d8903a209f6516 [4] - linux/386: sha256:2f00aaf9bf92f199a8b6cb1ea1e6c99a670608f331c244df4ce9bd11707b6399 [5] - linux/arm/v7: sha256:c3b000a466cb7f33195e37dbe04c14bf07fdaa159774bcc271f40a3e41f9de01 [6] 1.26.0 Stable and Labs The 1.26.0 version is released on both channels [7]: - Stable: docker/dockerfile:1.26.0 contains the standard, production-ready features [7][1]. - Labs: docker/dockerfile:1.26.0-labs includes all features from the stable 1.26.0 release, plus additional experimental or early-access features [1][8]. The labs channel is designed for testing new functionality before it is promoted to the stable channel [1][8]. While labs images generally follow the same versioning pattern as stable, early-access features in labs may not follow semantic versioning and could be subject to breaking changes [1]. It is recommended to pin specific versions if you are using the labs channel to ensure consistent behavior [3][1].
Citations:
- 1: https://docs.docker.com/build/buildkit/frontend/
- 2: https://hub.docker.com/r/docker/dockerfile/tags/
- 3: https://hub.docker.com/r/docker/dockerfile/
- 4: https://hub.docker.com/layers/docker/dockerfile/1.25.0/images/sha256-3d6d54b33351b396a910d33248754b86b1d7dd838b4eeb9575d8903a209f6516
- 5: https://hub.docker.com/layers/docker/dockerfile/1.25.0/images/sha256-2f00aaf9bf92f199a8b6cb1ea1e6c99a670608f331c244df4ce9bd11707b6399
- 6: https://hub.docker.com/layers/docker/dockerfile/1.25.0/images/sha256-c3b000a466cb7f33195e37dbe04c14bf07fdaa159774bcc271f40a3e41f9de01
- 7: https://github.com/moby/buildkit/releases
- 8: COPY note for --exclude feels/is misleading docker/docs#22055
🌐 Web query:
docker/dockerfile Docker Hub tags latest 1.25.0 1.26.0
💡 Result:
The docker/dockerfile repository on Docker Hub provides official Dockerfile frontend images used by BuildKit [1][2]. These images are organized into two primary release channels: latest (stable) and labs [1][2]. Tags such as 1.25.0 and 1.26.0 are specific, immutable releases [2]. The repository also provides semver-based rolling tags like 1.25 and 1.26, which are updated automatically to the latest patch release within that version branch (e.g., 1.25 tracks the latest 1.25.x release) until the next minor version is released [2]. Regarding the specific tags you mentioned: - 1.25.0: A specific, immutable patch release [2]. - 1.26.0: A specific, immutable patch release [2]. - latest: This tag typically points to the most recent stable release of the Dockerfile frontend [1][2]. For most users, it is recommended to use the syntax # syntax=docker/dockerfile:1 in your Dockerfile [3]. This ensures you always receive the latest stable updates and bug fixes for the major version 1 release without needing to manually update the tag [1][3]. If you require specific behavior, you may pin to an immutable tag like 1.26.0 [2]. There is also a labs channel (e.g., 1.26-labs), which contains experimental features and uses an incrementing numbering scheme [1][4].
Citations:
- 1: https://hub.docker.com/r/docker/dockerfile
- 2: https://docs.docker.com/build/buildkit/frontend/
- 3: https://docs.docker.com/reference/dockerfile
- 4: https://hub.docker.com/r/docker/dockerfile-upstream
Use the intended 1.25.0 digest for this pin.
docker/dockerfile:1.26.0 is a valid stable tag, but the pinned digest sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 should not be used with a different tag. Update the digest to the exact manifest for docker/dockerfile:1.25.0.
🧰 Tools
🪛 Trivy (0.72.0)
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 1, Update the Dockerfile syntax directive to use the
intended docker/dockerfile:1.25.0 tag and replace its digest with the exact
manifest digest for that tag, keeping the immutable tag-and-digest pin
consistent.
This PR contains the following updates:
1.19.0->1.26.0Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
Summary by CodeRabbit