From 865b43bf4907bd0d714c2f5540682285269f34b5 Mon Sep 17 00:00:00 2001 From: Dmitrii Creed Date: Sat, 16 May 2026 15:22:46 +0400 Subject: [PATCH] chore(docs): bump example Dockerfiles to Node 22 LTS + Caddy 2.11, SHA-pinned MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two improvements in one pass: 1. Bump base images to current LTS / stable. Today (2026-05-16): - Node 18 LTS ended April 2025 — last `node:18-alpine` push was 2025-03-27, no security updates since. - Node 22 is the current active LTS (until October 2027), refreshed this week. → bumped 6 example Dockerfiles to `node:22-alpine`. - Caddy 2.7 last updated May 2024; Caddy 2.11 is current stable. → bumped the 1 caddy example to `caddy:2.11-alpine`. 2. Pin every example FROM by `@sha256:`. Documentation examples should model the secure practice we recommend for production — readers copying these as a starting point now inherit a pinned, deterministic, reproducible build. Closes the OpenSSF Scorecard `Pinned-Dependencies` warnings for the 8 example Dockerfiles (containerImage findings). Digests used (resolved via Docker Hub registry API on 2026-05-16): node:22-alpine sha256:757ec364de4d37cedf30871be2988927660834e656e9aa52aad9ac194814c30c caddy:2.11-alpine sha256:3739ea4f0c877259a693d932693cf8f3408e9a9497c004f031b0e830e93e1546 Files touched (all in `docs/docs/examples/`): advanced-configs/high-resource/Dockerfile ecs-deployments/backend-service/Dockerfile ecs-deployments/blockchain-service/Dockerfile ecs-deployments/blog-platform/caddy.Dockerfile ecs-deployments/meteor-app/Dockerfile (multi-stage: 2 FROM lines) kubernetes-native/streaming-platform/Dockerfile kubernetes-vpa/Dockerfile Refs OpenSSF Scorecard climb plan in HARDENING.md. Signed-off-by: Dmitrii Creed --- docs/docs/examples/advanced-configs/high-resource/Dockerfile | 2 +- docs/docs/examples/ecs-deployments/backend-service/Dockerfile | 2 +- .../examples/ecs-deployments/blockchain-service/Dockerfile | 2 +- .../examples/ecs-deployments/blog-platform/caddy.Dockerfile | 2 +- docs/docs/examples/ecs-deployments/meteor-app/Dockerfile | 4 ++-- .../examples/kubernetes-native/streaming-platform/Dockerfile | 2 +- docs/docs/examples/kubernetes-vpa/Dockerfile | 2 +- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/docs/examples/advanced-configs/high-resource/Dockerfile b/docs/docs/examples/advanced-configs/high-resource/Dockerfile index 4c6d8d64..d01f8162 100644 --- a/docs/docs/examples/advanced-configs/high-resource/Dockerfile +++ b/docs/docs/examples/advanced-configs/high-resource/Dockerfile @@ -1,5 +1,5 @@ # AI Development Environment Dockerfile -FROM node:18-alpine +FROM node:22-alpine@sha256:757ec364de4d37cedf30871be2988927660834e656e9aa52aad9ac194814c30c # Install system dependencies RUN apk add --no-cache \ diff --git a/docs/docs/examples/ecs-deployments/backend-service/Dockerfile b/docs/docs/examples/ecs-deployments/backend-service/Dockerfile index 118ca1e7..7b5603ed 100644 --- a/docs/docs/examples/ecs-deployments/backend-service/Dockerfile +++ b/docs/docs/examples/ecs-deployments/backend-service/Dockerfile @@ -1,5 +1,5 @@ # Node.js backend service Dockerfile -FROM node:18-alpine +FROM node:22-alpine@sha256:757ec364de4d37cedf30871be2988927660834e656e9aa52aad9ac194814c30c # Install dumb-init for proper signal handling RUN apk add --no-cache dumb-init curl diff --git a/docs/docs/examples/ecs-deployments/blockchain-service/Dockerfile b/docs/docs/examples/ecs-deployments/blockchain-service/Dockerfile index 83a243fe..d887169b 100644 --- a/docs/docs/examples/ecs-deployments/blockchain-service/Dockerfile +++ b/docs/docs/examples/ecs-deployments/blockchain-service/Dockerfile @@ -1,5 +1,5 @@ # Node.js blockchain service Dockerfile -FROM node:18-alpine +FROM node:22-alpine@sha256:757ec364de4d37cedf30871be2988927660834e656e9aa52aad9ac194814c30c # Install dumb-init for proper signal handling RUN apk add --no-cache dumb-init curl diff --git a/docs/docs/examples/ecs-deployments/blog-platform/caddy.Dockerfile b/docs/docs/examples/ecs-deployments/blog-platform/caddy.Dockerfile index e120508a..81f8ee7a 100644 --- a/docs/docs/examples/ecs-deployments/blog-platform/caddy.Dockerfile +++ b/docs/docs/examples/ecs-deployments/blog-platform/caddy.Dockerfile @@ -1,4 +1,4 @@ -FROM caddy:2.7-alpine +FROM caddy:2.11-alpine@sha256:3739ea4f0c877259a693d932693cf8f3408e9a9497c004f031b0e830e93e1546 # Copy custom Caddyfile COPY Caddyfile /etc/caddy/Caddyfile diff --git a/docs/docs/examples/ecs-deployments/meteor-app/Dockerfile b/docs/docs/examples/ecs-deployments/meteor-app/Dockerfile index 0d0258f8..69ef4ad3 100644 --- a/docs/docs/examples/ecs-deployments/meteor-app/Dockerfile +++ b/docs/docs/examples/ecs-deployments/meteor-app/Dockerfile @@ -1,5 +1,5 @@ # Multi-stage build for Meteor.js application -FROM node:18-alpine AS builder +FROM node:22-alpine@sha256:757ec364de4d37cedf30871be2988927660834e656e9aa52aad9ac194814c30c AS builder # Install Meteor RUN npm install -g meteor @@ -21,7 +21,7 @@ RUN meteor npm install RUN meteor build --directory /app/build --architecture os.linux.x86_64 # Production stage -FROM node:18-alpine +FROM node:22-alpine@sha256:757ec364de4d37cedf30871be2988927660834e656e9aa52aad9ac194814c30c # Install dumb-init for proper signal handling RUN apk add --no-cache dumb-init diff --git a/docs/docs/examples/kubernetes-native/streaming-platform/Dockerfile b/docs/docs/examples/kubernetes-native/streaming-platform/Dockerfile index d4db793f..e7830276 100644 --- a/docs/docs/examples/kubernetes-native/streaming-platform/Dockerfile +++ b/docs/docs/examples/kubernetes-native/streaming-platform/Dockerfile @@ -1,5 +1,5 @@ # Node.js streaming platform Dockerfile -FROM node:18-alpine +FROM node:22-alpine@sha256:757ec364de4d37cedf30871be2988927660834e656e9aa52aad9ac194814c30c # Install dumb-init for proper signal handling RUN apk add --no-cache dumb-init curl diff --git a/docs/docs/examples/kubernetes-vpa/Dockerfile b/docs/docs/examples/kubernetes-vpa/Dockerfile index a5810f97..100ec890 100644 --- a/docs/docs/examples/kubernetes-vpa/Dockerfile +++ b/docs/docs/examples/kubernetes-vpa/Dockerfile @@ -1,4 +1,4 @@ -FROM node:18-alpine +FROM node:22-alpine@sha256:757ec364de4d37cedf30871be2988927660834e656e9aa52aad9ac194814c30c WORKDIR /app