chore: migrate base images to Chainguard - #1
Open
sachin-spotdraft wants to merge 1 commit into
Open
Conversation
Replace public base images with Chainguard equivalents from cgr.dev/spotdraft.com. - Uses -fips variants where available - Build stages use :latest-dev (shell available) - Runtime stages use :latest (minimal) - Platform pinned to linux/amd64
![baz-reviewer[bot]](https://avatars.githubusercontent.com/in/933528?s=60&v=4){kind=small}
| @@ -1,4 +1,4 @@ | |||
| FROM python:2.7.11-alpine | |||
| FROM --platform=linux/amd64 cgr.dev/spotdraft.com/python-fips:2.7.11-dev | |||
There was a problem hiding this comment.
CI cannot pull private base image
.drone.yml only provides Docker Hub publish credentials, so the publish-docker plugin has no way to authenticate to cgr.dev and pull the private cgr.dev/spotdraft.com/python-fips:2.7.11-dev base image — should we configure base-image registry credentials or authenticate cgr.dev in the pipeline?
Want Baz to fix this for you? Activate Fixer
Prompt for AI Agents
Before applying, verify this suggestion against the current code. In the Dockerfile's
`FROM --platform=linux/amd64 cgr.dev/spotdraft.com/python-fips:2.7.11-dev` base image,
the pipeline can't pull the private `cgr.dev` image because Drone's Docker publish
credentials only cover Docker Hub. Refactor `.drone.yml` so the docker plugin
authenticates to `cgr.dev` before evaluating the `FROM` image — add the plugin's base
image registry/username/password (or a secrets-based login), or insert an explicit
`docker login` step for `cgr.dev` using newly added secrets. Verify the `publish-docker`
step succeeds without relying on preconfigured runner state.
Author
These Dockerfile lines were left unchanged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
Summary
cgr.dev/spotdraft.com:latest-dev(includes shell):latest(minimal, no shell)linux/amd64Images updated
See Dockerfile diffs above.
🤖 Generated by chainguard-migrate.sh
Generated description
Below is a concise technical summary of the changes proposed in this PR:
Migrate the Docker build base from the public Python Alpine image to Chainguard’s FIPS-enabled Python development image. Pin the build platform to
linux/amd64while retaining the existing Python application build flow.Latest Contributors(2)