Update Node.js image to specific SHA256 digest#45
Conversation
There was a problem hiding this comment.
Pull request overview
Pins the Docker base image to a specific immutable Node.js 18 slim image digest to make builds reproducible and prevent unintentional base-image drift.
Changes:
- Update
FROM node:18-slimto a specific@sha256digest
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -1,4 +1,4 @@ | |||
| FROM node:18-slim | |||
| FROM node:18-slim@sha256:f9ab18e354e6855ae56ef2b290dd225c1e51a564f87584b9bd21dd651838830e | |||
There was a problem hiding this comment.
Node.js 18 is end-of-life (no security updates). Since this image is now pinned to a Node 18 digest, we’ll be locked onto an unsupported runtime; please upgrade the base image to an actively supported LTS (e.g., Node 20/22) and update the pinned digest accordingly.
| FROM node:18-slim@sha256:f9ab18e354e6855ae56ef2b290dd225c1e51a564f87584b9bd21dd651838830e | |
| FROM node:20-slim |
| @@ -1,4 +1,4 @@ | |||
| FROM node:18-slim | |||
| FROM node:18-slim@sha256:f9ab18e354e6855ae56ef2b290dd225c1e51a564f87584b9bd21dd651838830e | |||
There was a problem hiding this comment.
Pinning the image by digest disables automatic base-image updates (including Debian security patches). Please ensure there is an automated process (e.g., Dependabot/Renovate for Docker) or a documented runbook to regularly bump this digest; otherwise the container will accumulate known CVEs over time.
| FROM node:18-slim@sha256:f9ab18e354e6855ae56ef2b290dd225c1e51a564f87584b9bd21dd651838830e | |
| FROM node:18-slim |
1 participant
No description provided.