From dc42d31595d9d2de37d04405e6e57e0792eb9917 Mon Sep 17 00:00:00 2001 From: Jonathon Wright Date: Tue, 23 Jun 2026 20:47:02 +1000 Subject: [PATCH] docker: digest-pin the node:22-bookworm-slim build base Pin the floating node:22-bookworm-slim tag to its index digest. The re-resolve of this unpinned docker.io tag every build was the recurring CI 'hang'. Paired with the bastion runner now pulling through the zot mirror, the base is fetched once and cached. (nginx runtime stage was already digest-pinned.) --- Dockerfile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 0f5a770..414f5f4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,10 @@ # pinned nginx-unprivileged runtime serving the static dist/. # ---- build stage ---------------------------------------------------------- -FROM node:22-bookworm-slim AS build +# Digest-pinned (was a floating tag → the docker.io re-resolve was the CI "build hang"). With the bastion +# runner pointed at the zot pull-through mirror, this exact layer is fetched once and cached. Bump the digest +# when intentionally moving Node. node:22-bookworm-slim index digest resolved 2026-06-23. +FROM node:22-bookworm-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS build WORKDIR /app # Install deps from the lockfile only first (better layer caching).