make images imutable #975

Activity

1. LaurentGoderre commented on Oct 8, 2024

   

   LaurentGoderre

   on Oct 8, 2024

   Member

   More actions

   Tags are not immutable by design so that they receive security fixes from the base images. For immutability, you need to use the image digest that the tag points to.
2. andreish commented on Oct 8, 2024

   

   andreish

   on Oct 8, 2024

   Last edited by andreish

   Author

   More actions

   Thanks.

   FYI :
   this used to build , now it is broken , maybe you can find why ...

   Dockerfile bad today, was good yesterday.

   FROM  python:3-alpine3.19
   
   RUN apk add --no-cache bash curl wget python3-dev  alpine-sdk && mkdir -p /srv
   WORKDIR /srv
   RUN python -m venv .venv
   RUN source .venv/bin/activate && pip install pandas==2.2.1
   
   

   --

   Dockerfile good today

   FROM alpine:3.19.4
   
   RUN apk add --no-cache bash curl wget python3-dev  alpine-sdk && mkdir -p /srv
   WORKDIR /srv
   RUN python -m venv .venv
   RUN source .venv/bin/activate && pip install pandas==2.2.1
   
   

   --
   does this mean it is python image update broken ?

   Is it any way from hub.docker.com to know the history of what sha was pointed to by a given tag ? I.e I want to know what sha was yesterday for python:3-alpine3.19 ?
3. andreish commented on Oct 8, 2024

   

   andreish

   on Oct 8, 2024

   Last edited by andreish

   Author

   More actions

   probably it is python version that caused this :
   it was
   ENV PYTHON_VERSION 3.13.0rc3
   and now it is
   ENV PYTHON_VERSION 3.13.0

   (at least this is here: 7c8595e#diff-92baf5d34140ab68c1204f3d90c1629f298492e03179d7a20916d3febb952f7eL20)

   hmm python:3-alpine3.19 used a not final version of python and now it uses a final one, not too intuitive ,I would say.
4. andreish commented on Oct 8, 2024

   

   andreish

   on Oct 8, 2024

   Author

   More actions

   pandas 2.2.3 works ok.
5. andreish

   closed this as completedon Oct 8, 2024
6. tianon commented on Oct 8, 2024

   

   tianon

   on Oct 8, 2024

   Member

   More actions

   The python:3-alpine3.19 tag is what I affectionately call a "square wheel" -- it's technically a rolling release, of a sort, but when it rolls, it rolls in a very blocky way -- in this case, you got bitten by the GA release of 3.13, so we "rolled" from 3.12 to 3.13. We maintain a variety of tags to help you control this "rolling" behavior (python:3.12-alpine3.19, python:3.12.6-alpine3.19), or as noted previously, if you need a fully "immutable" base image, that's what the content digests are for. 👍
7. tianon commented on Oct 8, 2024

   

   tianon

   on Oct 8, 2024

   Last edited by yosifkit

   Member

   More actions

   Also, to be clear, if Python 3.13.0rc3 was never pushed to a python:3 bare tag, that's a bug. Up until the 3.13 GA release, all "3" tags were pointing at the previous GA, 3.12.