Pin versions in
apk add DOK-DL3018
Bug risk
Major
5 months ago
—
4 years old
Pin versions in apk add. Instead of
apk add <package> use apk add <package>=<version>39RUN apk --no-cache add libmagic cairo pango ttf-opensans && \
40 apk --no-cache add postgresql-libs libxslt jpeg zlib libxml2 # those *might* be useful
41# Various fonts for proper name printing
42RUN apk --no-cache add fontconfig font-noto-gujarati font-noto-kannada && \43 apk --no-cache add font-noto-osage font-noto-kayahli font-noto-oriya && \
44 apk --no-cache add font-noto-telugu font-noto-tamil font-noto-bengali && \
45 apk --no-cache add font-noto-malayalam font-noto-arabic font-noto-extra && \Pin versions in apk add. Instead of
apk add <package> use apk add <package>=<version>36FROM base
37
38# these libs are necessary for operation
39RUN apk --no-cache add libmagic cairo pango ttf-opensans && \40 apk --no-cache add postgresql-libs libxslt jpeg zlib libxml2 # those *might* be useful
41# Various fonts for proper name printing
42RUN apk --no-cache add fontconfig font-noto-gujarati font-noto-kannada && \Pin versions in apk add. Instead of
apk add <package> use apk add <package>=<version>12
13RUN apk --no-cache add postgresql-libs ca-certificates libxslt jpeg zlib file libxml2
14# PDF Generation: weasyprint
15RUN apk --no-cache add cairo-dev pango-dev ttf-opensans16
17# Note: The custom PyPI repo is for AlpineOS only, where Python packages are compiled with musl libc. Don't use it on glibc Linux.
18ENV POETRY_HOME=/opt/poetry \Pin versions in apk add. Instead of
apk add <package> use apk add <package>=<version>10# PDF Generation: weasyprint (libffi-dev jpeg-dev already included above)
11RUN apk add --virtual gdk-pixbuf-dev
12
13RUN apk --no-cache add postgresql-libs ca-certificates libxslt jpeg zlib file libxml214# PDF Generation: weasyprint
15RUN apk --no-cache add cairo-dev pango-dev ttf-opensans
16Pin versions in apk add. Instead of
apk add <package> use apk add <package>=<version> 4
5FROM base as builder
6
7RUN apk update && \ 8 apk add --virtual build-deps make git g++ python3-dev musl-dev jpeg-dev zlib-dev libevent-dev file-dev libffi-dev openssl && \
9 apk add postgresql-dev libxml2-dev libxslt-dev
10# PDF Generation: weasyprint (libffi-dev jpeg-dev already included above)
Description
Version pinning forces the build to retrieve a limited range of versions, or an exact particular version, regardless of what’s in the cache. This technique can also reduce failures due to unanticipated changes in required packages. See best practices for writing Dockerfiles.
Bad Practice
FROM alpine:3.7
RUN apk --no-cache add foo
Recommended
FROM alpine:3.7
RUN apk --no-cache add foo=~1.23
# or
RUN apk --no-cache add foo=1.2.3
Note: Pinning exact versions can cause future builds to suddenly fail if that version is no longer available. Use with caution.