Pin apk versions

Author: thomasleplus

openid-connect-provider-debugger/Dockerfile

@@ -3,19 +3,25 @@ FROM openresty/openresty:1.27.1.1-alpine-fat@sha256:aa8ea52fa35a296558aed8b392fb
 
 ARG LUA_RESTY_OPENIDC_VERSION="1.7.6"
 
-HEALTHCHECK CMD ["/usr/bin/curl", "-i", "-s", "-S", "-f", "http://localhost"]
+SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+HEALTHCHECK CMD ["/usr/bin/curl", "-i", "-s", "-S", "-f", "http://localhost"]
 
 COPY nginx.conf.patch /usr/local/openresty/nginx/conf/
 
-# hadolint ignore=DL3018,DL4006
-RUN apk update \
- && apk --no-cache add curl patch \
- && rm -rf /var/cache/apk/* \
- && /usr/local/openresty/luajit/bin/luarocks install lua-resty-openidc --pin "${LUA_RESTY_OPENIDC_VERSION}" \
- && patch /usr/local/openresty/nginx/conf/nginx.conf /usr/local/openresty/nginx/conf/nginx.conf.patch \
- && rm -f /usr/local/openresty/nginx/conf/nginx.conf.patch
+# hadolint ignore=DL4006
+RUN apk -U upgrade \
+    && apk add \
+    curl=8.12.1-r0 \
+    patch=2.7.6-r10 \
+    && if [[ $(apk -u list) ]] ; then \
+      apk -u list ; \
+      exit 1 ; \
+    fi \
+    && rm -rf /var/cache/apk/* \
+    && /usr/local/openresty/luajit/bin/luarocks install lua-resty-openidc --pin "${LUA_RESTY_OPENIDC_VERSION}" \
+    && patch /usr/local/openresty/nginx/conf/nginx.conf /usr/local/openresty/nginx/conf/nginx.conf.patch \
+    && rm -f /usr/local/openresty/nginx/conf/nginx.conf.patch
 
 COPY default.conf /etc/nginx/conf.d/
 

openid-connect-provider-debugger/Dockerfile-test

@@ -9,10 +9,16 @@ ARG USER_HOME=/home/default
 ARG USER_ID=1000
 ARG USER_GECOS=Default
 
-# hadolint ignore=DL3018
-RUN apk update \
- && apk --no-cache add curl \
- && rm -rf /var/cache/apk/*
+SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
+
+RUN apk -U upgrade \
+    && apk add \
+    curl==8.12.1-r0 \
+    && if [[ $(apk -u list) ]] ; then \
+      apk -u list ; \
+      exit 1 ; \
+    fi \
+    && rm -rf /var/cache/apk/*
 
 RUN adduser \
   --home "${USER_HOME}" \
@@ -28,4 +34,4 @@ USER "${USER_NAME}"
 WORKDIR "${HOME}"
 
 # sleep 60s to make sure that container survived its own healthcheck
-CMD ["/bin/sh", "-c", "/bin/sleep 60 ; /usr/bin/curl -i -s -S -f http://openid-connect-provider-debugger"]
+CMD ["/bin/bash", "-euo", "pipefail", "-c", "/bin/sleep 60 ; /usr/bin/curl -i -s -S -f http://openid-connect-provider-debugger"]