build: pin nginx base image version for reproducible builds#220
build: pin nginx base image version for reproducible builds#220andrerfneves wants to merge 1 commit into
Conversation
Change FROM nginx:alpine to FROM nginx:1.25-alpine to use a pinned version tag instead of the floating :alpine tag. The builder stage already pins Node.js to node:20-alpine, making the production stage the only unpinned image. Using a floating tag like :alpine can lead to unexpected build breaks when nginx releases a new major version. Pinning to the 1.25-alpine series ensures consistent, reproducible builds while still receiving patch updates.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 66524d9e3d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| # Production stage | ||
| FROM nginx:alpine | ||
| FROM nginx:1.25-alpine |
There was a problem hiding this comment.
For Docker deployments built after this change, the production stage is pinned to nginx 1.25.x; that line's security support ended on May 29, 2024 and its latest release was 1.25.5 on Apr 16, 2024, while the previous nginx:alpine tag tracks a supported official image. This turns rebuilds into stale web-server images that no longer pick up nginx security fixes, so pin to a currently supported series or digest instead.
Useful? React with 👍 / 👎.
1 participant
Summary
Pins the nginx base image from the floating
:alpinetag tonginx:1.25-alpinefor reproducible Docker builds.Why
The builder stage already uses
FROM node:20-alpine(pinned to the v20 series), but the production stage usedFROM nginx:alpine— a floating tag that follows the latest stable nginx release. This means:Pinning to
nginx:1.25-alpinefollows the same pattern asnode:20-alpine— it tracks patch releases within a stable series while preventing unexpected major version jumps.Changes
Dockerfile: ChangedFROM nginx:alpine→FROM nginx:1.25-alpineTest Plan