build: Pin node24/alpine3.22 base images to digests in Docker build (#31772)

Co-authored-by: n8n-cat-bot[bot] <n8n-cat-bot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
n8n-cat-bot[bot] 2026-06-04 20:37:00 +01:00 committed by GitHub
parent 942682e66a
commit f301e434ee
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 6 additions and 2 deletions

View File

@ -1,6 +1,8 @@
ARG NODE_VERSION=24.15.0
FROM dhi.io/node:${NODE_VERSION}-alpine3.22-dev
# Pinned to multi-arch index digest (linux/amd64 + linux/arm64) for reproducible builds.
# Bump the digest together with the tag when updating the base image.
FROM dhi.io/node:24.15.0-alpine3.22-dev@sha256:a7eead704e9bd2d7a4c1b52cf595848f180365eba7c15a185ce1c3a690c1a19d
ARG NODE_VERSION

View File

@ -2,7 +2,9 @@ ARG NODE_VERSION=24.15.0
ARG N8N_VERSION=snapshot
# Builder stage exists because the runtime base image has no toolchain.
FROM node:${NODE_VERSION}-alpine3.22 AS builder
# Pinned to multi-arch index digest (linux/amd64 + linux/arm64) for reproducible builds.
# Bump the digest together with the tag when updating the base image.
FROM node:24.15.0-alpine3.22@sha256:b689d4005875ae167178471a7a622ec2909459a3bbb32277260be1971af7a99f AS builder
COPY ./compiled /usr/local/lib/node_modules/n8n
RUN apk add --no-cache python3 make g++ && \
cd /usr/local/lib/node_modules/n8n && \