Skip to content

Update docker/dockerfile Docker tag to v1.26.0 (from 1.19.0) #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Erwan-loot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update docker/dockerfile Docker tag to v1.26.0 (from 1.19.0) #36

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# syntax=docker/dockerfile:1.19.0@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6
# syntax=docker/dockerfile:1.26.0@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32

@coderabbitai coderabbitai Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n '^\s*(FROM|USER)\b' Dockerfile

Repository: Erwan-loot/Warracker

Length of output: 388

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo '--- Dockerfile relevant section ---'
sed -n '1,120p' Dockerfile

echo
echo '--- Dockerfiles matching FROM/USER outside of syntax/header comments ---'
rg -n '^\s*(FROM|USER)\b' Dockerfile

Repository: Erwan-loot/Warracker

Length of output: 5072

Set the final Dockerfile USER to the non-root user.

The runtime stage creates warracker, but the Dockerfile does not switch to it. Add USER warracker before any remaining CMD/ENTRYPOINT instructions so Docker does not run the final container as root.

🧰 Tools
🪛 Trivy (0.72.0)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS-0002

Learn more

(IaC/Dockerfile)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` at line 1, Set the final Dockerfile runtime user to warracker by
adding USER warracker after the runtime setup and before any remaining CMD or
ENTRYPOINT instructions, ensuring the container does not run as root.

Source: Linters/SAST tools

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

docker buildx imagetools inspect docker/dockerfile:1.25.0
docker buildx imagetools inspect docker/dockerfile:1.25.0@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32

Repository: Erwan-loot/Warracker

Length of output: 202

🌐 Web query:

Docker Hub docker/dockerfile 1.25.0 tag digest docker/dockerfile:1.26.0 stable labs

💡 Result:

The docker/dockerfile image repository maintains two distinct release channels: stable and labs [1]. Regarding your specific version queries: 1.25.0 Digest The docker/dockerfile:1.25.0 image is a stable release [2][3]. As a multi-architecture image, its digest depends on the specific platform (OS/architecture). For example, common digests include: - linux/amd64: sha256:3d6d54b33351b396a910d33248754b86b1d7dd838b4eeb9575d8903a209f6516 [4] - linux/386: sha256:2f00aaf9bf92f199a8b6cb1ea1e6c99a670608f331c244df4ce9bd11707b6399 [5] - linux/arm/v7: sha256:c3b000a466cb7f33195e37dbe04c14bf07fdaa159774bcc271f40a3e41f9de01 [6] 1.26.0 Stable and Labs The 1.26.0 version is released on both channels [7]: - Stable: docker/dockerfile:1.26.0 contains the standard, production-ready features [7][1]. - Labs: docker/dockerfile:1.26.0-labs includes all features from the stable 1.26.0 release, plus additional experimental or early-access features [1][8]. The labs channel is designed for testing new functionality before it is promoted to the stable channel [1][8]. While labs images generally follow the same versioning pattern as stable, early-access features in labs may not follow semantic versioning and could be subject to breaking changes [1]. It is recommended to pin specific versions if you are using the labs channel to ensure consistent behavior [3][1].

Citations:

🌐 Web query:

docker/dockerfile Docker Hub tags latest 1.25.0 1.26.0

💡 Result:

The docker/dockerfile repository on Docker Hub provides official Dockerfile frontend images used by BuildKit [1][2]. These images are organized into two primary release channels: latest (stable) and labs [1][2]. Tags such as 1.25.0 and 1.26.0 are specific, immutable releases [2]. The repository also provides semver-based rolling tags like 1.25 and 1.26, which are updated automatically to the latest patch release within that version branch (e.g., 1.25 tracks the latest 1.25.x release) until the next minor version is released [2]. Regarding the specific tags you mentioned: - 1.25.0: A specific, immutable patch release [2]. - 1.26.0: A specific, immutable patch release [2]. - latest: This tag typically points to the most recent stable release of the Dockerfile frontend [1][2]. For most users, it is recommended to use the syntax # syntax=docker/dockerfile:1 in your Dockerfile [3]. This ensures you always receive the latest stable updates and bug fixes for the major version 1 release without needing to manually update the tag [1][3]. If you require specific behavior, you may pin to an immutable tag like 1.26.0 [2]. There is also a labs channel (e.g., 1.26-labs), which contains experimental features and uses an incrementing numbering scheme [1][4].

Citations:

Use the intended 1.25.0 digest for this pin.

docker/dockerfile:1.26.0 is a valid stable tag, but the pinned digest sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 should not be used with a different tag. Update the digest to the exact manifest for docker/dockerfile:1.25.0.

🧰 Tools
🪛 Trivy (0.72.0)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS-0002

Learn more

(IaC/Dockerfile)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` at line 1, Update the Dockerfile syntax directive to use the
intended docker/dockerfile:1.25.0 tag and replace its digest with the exact
manifest digest for that tag, keeping the immutable tag-and-digest pin
consistent.


# renovate: datasource=deb depName=build-essential
ARG BUILD_ESSENTIAL_VERSION=12.12
Expand Down