cluster

commit 8b4c5df9919b33acbaf99fcaa4991f577476b5a0
parent 159dbcc92c1c2efb1c627eba404cabc1748ce87a
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Thu,  9 Apr 2026 12:03:08 +0200

set the digests

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
apps/talos_cluster/blog/docker/Dockerfile
 | 
2
+-
M
apps/talos_cluster/continuwuity/Dockerfile
 | 
6
+++---
M
apps/talos_cluster/matrix-backup/backup-tool/Dockerfile
 | 
4
++--

3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/apps/talos_cluster/blog/docker/Dockerfile b/apps/talos_cluster/blog/docker/Dockerfile
@@ -1,6 +1,6 @@
 # Use Ubuntu as the base image
 # {"$imagepolicy": "flux-system:docker-ubuntu-25"}
-FROM ubuntu:25.10
+FROM ubuntu:25.10@sha256:4a9232cc47bf99defcc8860ef6222c99773330367fcecbf21ba2edb0b810a31e
 
 # Non-interactive frontend for apt and set timezone
 ARG DEBIAN_FRONTEND=noninteractive
diff --git a/apps/talos_cluster/continuwuity/Dockerfile b/apps/talos_cluster/continuwuity/Dockerfile
@@ -1,12 +1,12 @@
 # Wraps the upstream continuwuity scratch-based image with a shell (debian:12-slim)
 # so that Velero pre/post backup hooks can freeze the process via SIGSTOP/SIGCONT.
 # {"$imagepolicy": "flux-system:forgejo-continuwuity-main"}
-FROM forgejo.ellis.link/continuwuation/continuwuity:main AS upstream
+FROM forgejo.ellis.link/continuwuation/continuwuity:main@sha256:070b2f916bef7d542171acd0add0a28efd6af9c9bff83c64b26a289637477d9d AS upstream
 
 # Build ldb and sst_dump from the exact RocksDB version continuwuity uses (10.10.1)
 # so MANIFEST format is guaranteed compatible for recovery operations.
 # {"$imagepolicy": "flux-system:docker-debian-12-slim"}
-FROM debian:12-slim AS rocksdb-tools-builder
+FROM debian:12-slim@sha256:13cb01d584d2c23f475c088c168a48f9a08f033a10460572fbfd10912ec5ba7c AS rocksdb-tools-builder
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         build-essential cmake git ca-certificates \
@@ -30,7 +30,7 @@ RUN cmake -B build \
     && cmake --build build --target ldb sst_dump -j$(nproc)
 
 # {"$imagepolicy": "flux-system:docker-debian-12-slim"}
-FROM debian:12-slim
+FROM debian:12-slim@sha256:13cb01d584d2c23f475c088c168a48f9a08f033a10460572fbfd10912ec5ba7c
 # Runtime deps for ldb/sst_dump
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
diff --git a/apps/talos_cluster/matrix-backup/backup-tool/Dockerfile b/apps/talos_cluster/matrix-backup/backup-tool/Dockerfile
@@ -3,7 +3,7 @@
 
 # Build stage runs on the native host arch; cross-compiles via GOARCH.
 # {"$imagepolicy": "flux-system:docker-golang-1-25-bookworm"}
-FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS builder
+FROM --platform=$BUILDPLATFORM golang:1.25-bookworm@sha256:29e59af995c51a5bf63d072eca973b918e0e7af4db0e4667aa73f1b8da1a6d8c AS builder
 ARG TARGETARCH
 
 WORKDIR /app
@@ -23,7 +23,7 @@ RUN CGO_ENABLED=0 GOARCH=${TARGETARCH} \
 
 # Runtime stage — distroless/static has no shell, no libc, minimal attack surface.
 # {"$imagepolicy": "flux-system:gcr-distroless-static-nonroot"}
-FROM gcr.io/distroless/static:nonroot
+FROM gcr.io/distroless/static:nonroot@sha256:64c43684e6d2b581d1eb362ea47b6a4defee6a9cac5f7ebbda3daa67e8c9b8e6
 
 COPY --from=builder /matrix-backup /matrix-backup