Merge pull request 'docker: digest-pin the node:22-bookworm-slim build base' (#2) from mirror/node-digest-pin into main

Reviewed-on: #2
2026-06-23 11:01:59 +00:00
parent c5d9da9092 dc42d31595
commit d64f528ff7
1 changed files with 4 additions and 1 deletions
@@ -3,7 +3,10 @@
 # pinned nginx-unprivileged runtime serving the static dist/.

 # ---- build stage ----------------------------------------------------------
-FROM node:22-bookworm-slim AS build
+# Digest-pinned (was a floating tag → the docker.io re-resolve was the CI "build hang"). With the bastion
+# runner pointed at the zot pull-through mirror, this exact layer is fetched once and cached. Bump the digest
+# when intentionally moving Node. node:22-bookworm-slim index digest resolved 2026-06-23.
+FROM node:22-bookworm-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS build
 WORKDIR /app

 # Install deps from the lockfile only first (better layer caching).