0

Dockerfiles usually contain FROM lines referring to a moving third-party image, such as "ubuntu:23.10" or even just "ubuntu". I'd like to pin all such references to the current digest of that image, so that it doesn't keep changing. That is, I'm looking for a tool which can change a Dockerfile line like

FROM ubuntu:23.10

to

FROM ubuntu:23.10@sha256:13f233a16be210b57907b98b0d927ceff7571df390701e14fe1f3901b2c4a4d7

Bonuses:

  • The tool should ideally be able to handle multi-stage builds, where some FROM lines refer back to previous stages of the same Dockerfile.
  • Docker Compose support would be nice.
  • The tool should actually parse the Dockerfile (rather than using naive regexes), so that it doesn't trip over any unusual syntax variations, like having space characters at the start of a FROM line or even multi-line FROM commands.

Manual workaround:

  1. Print the FROM values:

    grep --only-matching --perl-regexp '(?<=FROM ).*' Dockerfile
    

    In case of a multi-stage build you need to manually exclude references to previous stages from the rest of the steps.

  2. Get the current digest suffix per IMAGE:

    docker inspect --format='{{index .RepoDigests 0}}' IMAGE | grep --only-matching '@.*'
    
    • If Docker complains about "Error: No such object: IMAGE", run docker pull IMAGE and retry.
      • If Docker complains about "Error response from daemon: manifest for IMAGE:latest not found: manifest unknown: manifest unknown", you'll have to manually find the relevant tag in Dockerhub and pull that instead.
  3. Add the output from the previous step to the FROM line.

2
  • What's the problem of scripting the manual workaround? You could also make the regex work with multistage builds.
    – Destroy666
    Nov 22, 2023 at 22:27
  • Not a problem per se, I just wanted to check whether there's an existing tool. I might not have the time to create it myself (it's for work).
    – l0b0
    Nov 22, 2023 at 23:05

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.