- Architect
- Designing a platform
How it works
Pin every external image by digest (FROM image:tag@sha256:..., image: ...@sha256:... in Compose), and move digests forward through reviewed changes, which tools such as Renovate or Dependabot propose. Pull only through a mirror you control, with immutable tags and a push account kept out of CI. Sign images and verify signatures at deploy time (cosign, Docker Content Trust), and keep a software bill of materials (docker buildx build --sbom=true) to know what is inside.
What breaks
Tags move: whoever can push to a repository can replace node:20-alpine with a backdoored copy that works perfectly, and docker build --pull or docker compose pull will fetch it on the next rebuild. A backdoored base image is invisible to every functional test. Pinning without a process to update digests freezes security patches instead.
In a Dockerfile
# Dockerfile
FROM registry.shop.internal/mirror/node:20-alpine@sha256:b0ff1116a2a7b674ba9d43a7b7fb5639bb9d453a13cd3fcebc9d46cd6f9f2963
# compose.yaml
# db:
# image: registry.shop.internal/mirror/postgres:16@sha256:3ff0cf6f859b...See it break, then fix it
Write the Dockerfile or the compose file, type the docker commands, and watch a simulated server run them through reboots, upgrades and traffic. Free to start.