dockpin - GitLite

KO | EN

gitlite — search

#ios #redis #dotnet #gpt #deep-learning #markdown #monitoring #ai-agents #api #csharp

dockpin

(★ 40)

A tool for pinning Docker image and apt package versions

파일 탐색기

ZIP 다운로드

- - dockpin-self-updater.yml
  - release.yml
  - test.yml
.gitignore
apt.go
docker.go
Dockerfile
go.mod
go.sum
LICENSE
logo.png
main.go
README.md

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

명령어 용어집

이 문서에서 사용된 명령어를 모아봤습니다. 낯선 명령어가 있다면 펼쳐서 확인해보세요.

🔍

`go install`

설명 보기 ▼

Compile and install packages named by the import paths.

go install

Compile and install the current package:

go install {{path/to/package}}

Compile and install a specific local package:

go install {{golang.org/x/tools/gopls}}@{{latest}}

Install the latest version of a program, ignoring `go.mod` in the current directory:

🔍

`apt-get`

설명 보기 ▼

Debian 및 Ubuntu 패키지 관리 도구.
`apt-cache`를 사용하여 패키지를 검색하세요.
Ubuntu 16.04 이후 버전에서는 대화형 사용 시 `apt` 사용을 권장합니다.
더 많은 정보: <https://manned.org/apt-get.8>.

sudo apt-get update

사용 가능한 패키지 및 버전 목록 업데이트 (다른 `apt-get` 명령어 실행 전에 권장됨):

sudo apt-get install {{package}}

패키지 설치 또는 최신 버전으로 업데이트:

sudo apt-get remove {{package}}

패키지 제거:

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<img align="right" src="logo.png" />

Install dockpin with: `go install github.com/Jille/dockpin@latest`

Dockpin helps you achieve repeatable builds. It pins base images in your Dockerfile, and packages you install with apt-get.

`dockpin docker pin -f Dockerfile` rewrites your Dockerfile to use the latest digest for each image. Docker will then use exactly that image until you upgrade it.

Dockpin can also pin apt packages, though it's slightly more complex:

```shell
$ (echo postgresql-12; echo curl) > dockpin-apt.pkgs
$ dockpin apt pin
```

then you can change your `apt-get update && apt-get install -y postgresql-12 curl && apt-get clean && rm -rf /var/lib/apt/lists/*` in your Dockerfile to:

```
FROM ghcr.io/jille/dockpin AS dockpin
FROM ubuntu:focal
COPY --from=dockpin /bin/dockpin /usr/local/sbin/dockpin
COPY dockpin-apt.lock /tmp
RUN /usr/local/sbin/dockpin apt install -p /tmp/dockpin-apt.lock
[...]
```

## Why repeatable builds?

If you do a small cherrypick, to fix a bug, and you're going to roll that out to prod with an accelerated push, you don't want to accidentally also pick up a new Python version.

Increasingly more people do pin versions, but never upgrade and stay on that version forever. That makes security folks shudder.

Dockpin aims to make it easy to move to new versions *when you want*.

## Docker pinning

This is pretty easy. You can either make dockpin rewrite your Dockerfile in place:

```shell
$ dockpin docker pin [-f your.Dockerfile]
```

or control output yourself:

```shell
$ dockpin docker pin -f - < Dockerfile.template > Dockerfile
```

## Apt pinning

You should create a file called dockpin-apt.pkgs which contains one Debian/Ubuntu package per line. After that you can run `dockpin apt pin` which generates dockpin-apt.lock, which contains the URLs and size/hash of each .deb file to use.

When you run `dockpin apt install` in your Dockerfile, it will read (only) dockpin-apt.lock and install all the listed packages at the pinned versions.

The easiest way to get the `dockpin` binary in your Docker build is by grabbing it from the ghcr.io/jille/dockpin image (as shown in the example at the top of this README).

Note that the Debian/Ubuntu archives will eventually delete the old package you pinned from their mirrors. At that point you'll get an error when you try to build (rather than a silent upgrade). You can reproduce your build by somehow finding the old .deb file and changing the lock file to point at whichever URL you put it at. You can also COPY it into /var/cache/apt/archives/ and `dockpin apt install` will use that without downloading.

We rely on apt(8) to figure out which dependencies you already have / need to install. However, that does mean that we need to do the pinning on the same base image as you'll run `dockpin apt install`. We try to guess this automatically by parsing your Dockerfile, but that might fail and you'll need to pass `--base-image=ubuntu:focal` (or whatever image you use).