mirror of
https://github.com/openclaw/openclaw.git
synced 2026-02-19 18:39:20 -05:00
8ae2d5110f
* fix(docker): pin base images to SHA256 digests for supply chain security Pin all 9 Dockerfiles to immutable SHA256 digests to prevent supply chain attacks where a compromised upstream image could be silently pulled into production builds. Also add Docker ecosystem to Dependabot configuration for automated digest updates. Images pinned: - node:22-bookworm@sha256:cd7bcd2e7a1e6f72052feb023c7f6b722205d3fcab7bbcbd2d1bfdab10b1e935 - node:22-bookworm-slim@sha256:3cfe526ec8dd62013b8843e8e5d4877e297b886e5aace4a59fec25dc20736e45 - debian:bookworm-slim@sha256:98f4b71de414932439ac6ac690d7060df1f27161073c5036a7553723881bffbe - ubuntu:24.04@sha256:cd1dba651b3080c3686ecf4e3c4220f026b521fb76978881737d24f200828b2b Fixes #7731 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * test(docker): add digest pinning regression coverage --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
26 lines
768 B
Docker
26 lines
768 B
Docker
FROM node:22-bookworm@sha256:cd7bcd2e7a1e6f72052feb023c7f6b722205d3fcab7bbcbd2d1bfdab10b1e935
|
|
|
|
RUN corepack enable
|
|
|
|
WORKDIR /app
|
|
|
|
ENV NODE_OPTIONS="--disable-warning=ExperimentalWarning"
|
|
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.json tsconfig.plugin-sdk.dts.json tsdown.config.ts vitest.config.ts vitest.e2e.config.ts openclaw.mjs ./
|
|
COPY src ./src
|
|
COPY test ./test
|
|
COPY scripts ./scripts
|
|
COPY docs ./docs
|
|
COPY skills ./skills
|
|
COPY patches ./patches
|
|
COPY ui ./ui
|
|
COPY extensions/memory-core ./extensions/memory-core
|
|
COPY vendor/a2ui/renderers/lit ./vendor/a2ui/renderers/lit
|
|
COPY apps/shared/OpenClawKit/Tools/CanvasA2UI ./apps/shared/OpenClawKit/Tools/CanvasA2UI
|
|
|
|
RUN pnpm install --frozen-lockfile
|
|
RUN pnpm build
|
|
RUN pnpm ui:build
|
|
|
|
CMD ["bash"]
|