From aaddc916c712c62c56de2f1f2715010dd953422d Mon Sep 17 00:00:00 2001 From: Hang Yin Date: Thu, 29 Oct 2026 14:46:48 +0000 Subject: [PATCH] fix(dev-box): pin image by digest Pin the first published build (sha-5a930ae, from the #169 merge) so the attested app-compose identifies the exact image instead of a moving :latest tag. Co-Authored-By: Claude Opus 5.5 --- dev-box/README.md | 4 ++-- dev-box/docker-compose.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dev-box/README.md b/dev-box/README.md index 168da42..1c2ee1f 100644 --- a/dev-box/README.md +++ b/dev-box/README.md @@ -12,7 +12,7 @@ Add the `dev-box` service from [`docker-compose.yaml`](./docker-compose.yaml) ne ```yaml services: dev-box: - image: ghcr.io/dstack-tee/dstack-dev-box:latest + image: ghcr.io/dstack-tee/dstack-dev-box:sha-5a930ae@sha256:2191420a255a0adbf5044700b848b0f5fc29c1c24323a1742054409f5f116d99 restart: unless-stopped privileged: true pid: host @@ -91,7 +91,7 @@ The host rootfs is a read-only, dm-verity-protected image, so tools can't be ins ## Build your own image -The compose file uses `ghcr.io/dstack-tee/dstack-dev-box:latest`, built from this directory by [`build-dev-box.yml`](../.github/workflows/build-dev-box.yml). To add packages, edit the [`Dockerfile`](./Dockerfile), push the image to a registry, and change `image:`. For a quick test, [ttl.sh](https://ttl.sh) holds anonymous images for up to 24 hours: +The compose file pins `ghcr.io/dstack-tee/dstack-dev-box` by digest, so the attested `app-compose` identifies the exact image. It's built from this directory by [`build-dev-box.yml`](../.github/workflows/build-dev-box.yml), which tags each `main` build `sha-` and `latest`. To add packages, edit the [`Dockerfile`](./Dockerfile), push the image to a registry, and change `image:`. For a quick test, [ttl.sh](https://ttl.sh) holds anonymous images for up to 24 hours: ```bash docker buildx build --platform linux/amd64 -t ttl.sh/my-dev-box:24h --push . diff --git a/dev-box/docker-compose.yaml b/dev-box/docker-compose.yaml index 15a3e98..6fe8ad3 100644 --- a/dev-box/docker-compose.yaml +++ b/dev-box/docker-compose.yaml @@ -7,7 +7,7 @@ # This gives full root on the CVM. Development/debugging only. services: dev-box: - image: ghcr.io/dstack-tee/dstack-dev-box:latest + image: ghcr.io/dstack-tee/dstack-dev-box:sha-5a930ae@sha256:2191420a255a0adbf5044700b848b0f5fc29c1c24323a1742054409f5f116d99 restart: unless-stopped privileged: true pid: host