starred/onyx
1
0 Fork 0
mirror of https://github.com/onyx-dot-app/onyx.git synced 2026-10-22 03:14:06 -05:00
Code Issues Packages Projects Releases 10 Wiki Activity

chore(deps): update node base image digests (#14583)

Browse Source 
Co-authored-by: onyx-cherry-pick[bot] <285052878+onyx-cherry-pick[bot]@users.noreply.github.com>
This commit is contained in:
onyx-cherry-pick[bot] authored and GitHub committed 2026-09-08 23:04:06 +00:00
1 parent ed65282219
commit 94271d7e11
5 files changed
+7 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.devcontainer/Dockerfile
+1 -1
View File
@@ -6,7 +6,7 @@ ARG BASE_IMAGE_REGISTRY=docker.io
# bun + node binary sources. Pinned via the registry prefix in their own stages because buildx
# rejects variable expansion directly in `COPY --from=` -- the ARG is only expandable in a FROM.
FROM ${BASE_IMAGE_REGISTRY}/oven/bun:1@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4 AS bun_source
FROM ${BASE_IMAGE_REGISTRY}/library/node:24.16.0-trixie-slim@sha256:05c08ce4291e9a58f59456a7985176defb12cdd42271f35ff81a3e167ea61d4c AS node_source
FROM ${BASE_IMAGE_REGISTRY}/library/node:24.16.0-trixie-slim@sha256:45fbb3ca3b6c7e6646cd2889d0ac7bf314bb180036da792221fc2f48fe4d43fb AS node_source
FROM ${BASE_IMAGE_REGISTRY}/library/ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b
.github/actions/dhi-base-images/action.yml
+2 -2
View File
@@ -46,8 +46,8 @@ runs:
run: |
{
echo "DHI_NODE_BUILD_ARGS<<EOF"
echo "NODE_BUILDER_IMAGE=dhi.io/node:24-debian13-dev@sha256:35dae551ffb9790b9e0416c5359c80b1b45c345b950b0670615a307451f0005f"
echo "NODE_RUNTIME_IMAGE=dhi.io/node:24-debian13@sha256:d6ae37f15884f5c9a3b945beba1dd5781b7107ecbcb72b64db9bbb7a74d7d870"
echo "NODE_BUILDER_IMAGE=dhi.io/node:24-debian13-dev@sha256:f0e1923112d1d0e9346cf0ec78cfd3cd280c1b5796661f86b9c39797bd219563"
echo "NODE_RUNTIME_IMAGE=dhi.io/node:24-debian13@sha256:499a967b45c046a93519d2fcbd7e0e165f92ccf25cdee9893cb51980957e2d7c"
echo "EOF"
echo "DHI_PYTHON_BUILD_ARGS<<EOF"
echo "PYTHON_BUILDER_IMAGE=dhi.io/python:3.13-debian13-dev@sha256:2ee447ace0ffcfebdb957e35d5411db1c2f48083b1e5a2a5fd04288c2ff5334e"
.github/workflows/release-opal.yml
+1 -1
View File
@@ -13,7 +13,7 @@ jobs:
# mitigates zizmor's cache-poisoning class of finding at the source rather than
# suppressing it. Bumping Node = bump the digest.
container:
image: node:24@sha256:3a198147c320bc4cc357b418955beb48413c0ea5ba60f9ec1568913631df33aa
image: node:24@sha256:be23f54a88d34e8824c741b19b91064094f92c1c97b194144bfc8b50d67258e2
environment:
name: release-opal
permissions:
backend/onyx/server/features/build/sandbox/image/Dockerfile
+1 -1
View File
@@ -17,7 +17,7 @@ FROM ${BASE_IMAGE_REGISTRY}/oven/bun:1.3.14@sha256:e10577f0db68676a7024391c6e5cb
# Node.js source. The final image is Python-based, but the sandbox still needs
# Node/npm/npx for MCP commands and skill-runtime packages.
FROM ${BASE_IMAGE_REGISTRY}/library/node:24-trixie-slim@sha256:45fbb3ca3b6c7e6646cd2889d0ac7bf314bb180036da792221fc2f48fe4d43fb AS node_source
FROM ${BASE_IMAGE_REGISTRY}/library/node:24-trixie-slim@sha256:50c3b2f6988dfc307b86e5301d69611af31f4789bdf232863b07d3b02fe55ae0 AS node_source
ARG NPM_VERSION=11.17.0
RUN npm install -g "npm@${NPM_VERSION}" && \
npm cache clean --force && \
web/Dockerfile
+2 -2
View File
@@ -7,8 +7,8 @@ ARG BASE_IMAGE_REGISTRY=docker.io
# no extra registry access. CI overrides both with the matching Docker Hardened Images from
# dhi.io, which need a Docker account with DHI catalog access.
# Refresh a digest with: docker buildx imagetools inspect <image reference>
ARG NODE_BUILDER_IMAGE=${BASE_IMAGE_REGISTRY}/library/node:24-trixie-slim@sha256:0711b541c1c33a8a530ac4f0d391baa9a15b3d804695b1b24a47daa5fb60e74d
ARG NODE_RUNTIME_IMAGE=${BASE_IMAGE_REGISTRY}/library/node:24-trixie-slim@sha256:0711b541c1c33a8a530ac4f0d391baa9a15b3d804695b1b24a47daa5fb60e74d
ARG NODE_BUILDER_IMAGE=${BASE_IMAGE_REGISTRY}/library/node:24-trixie-slim@sha256:50c3b2f6988dfc307b86e5301d69611af31f4789bdf232863b07d3b02fe55ae0
ARG NODE_RUNTIME_IMAGE=${BASE_IMAGE_REGISTRY}/library/node:24-trixie-slim@sha256:50c3b2f6988dfc307b86e5301d69611af31f4789bdf232863b07d3b02fe55ae0
# bun binary source, in its own stage because buildx only expands the registry ARG in a FROM,
# not in `COPY --from=`. Use the glibc (Debian) build so it runs on the glibc node images.