veilor-org/infra
1
0
Fork 0
Code Issues 7 Pull requests Projects Releases Packages Wiki Activity Actions

F25: 11/22 Docker images on :latest floating tag #4

New issue
Open
opened 2026-05-06 10:56:40 +01:00 by s8n · 0 comments
s8n commented 2026-05-06 10:56:40 +01:00
Owner
Copy link

Severity: Medium
Status: Open — 2 of 22 stacks pinned (misskey + x-source); 11 still on :latest.

docker compose pull on restart can load a different image than what was running. Supply-chain risk + reproducibility loss.

Fix: Migrate stacks to image digests (@sha256:...) and use renovate-bot or Forgejo Actions to bump on schedule. List of remaining :latest images:

  • pihole, rocketchat, headscale, anythingllm, filebrowser-mc, authentik, forgejo (worker), forgejo-runner, n8n, n8n-db, step-ca

Verification: docker compose config | grep image: shows digest, not tag.

Source: security/nullstone-server/2026-05-02.md §F25.

**Severity:** Medium **Status:** Open — 2 of 22 stacks pinned (misskey + x-source); 11 still on `:latest`. `docker compose pull` on restart can load a different image than what was running. Supply-chain risk + reproducibility loss. **Fix:** Migrate stacks to image digests (`@sha256:...`) and use renovate-bot or Forgejo Actions to bump on schedule. List of remaining `:latest` images: - pihole, rocketchat, headscale, anythingllm, filebrowser-mc, authentik, forgejo (worker), forgejo-runner, n8n, n8n-db, step-ca **Verification:** `docker compose config | grep image:` shows digest, not tag. Source: `security/nullstone-server/2026-05-02.md` §F25.
s8n added the
audit
infra
medium
 labels 2026-05-06 10:56:40 +01:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
backup/pre-rename-2026-05-07/main
No results found.
Labels
Clear labels   
audit

   
critical

   
deferred

   
high

   
infra

   
medium

   
security
No labels
audit
critical
deferred
high
infra
medium
security
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: veilor-org/infra#4
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?