markhobson / locker

Locks Docker image references by digest.

Locker

Locks Docker image references by digest.

Docker images are typically specified by their name and tag in Dockerfiles. Unfortunately tags are mutable which can cause non-deterministic behaviour at a later date. To avoid this, digests can be used to lock images to an immutable version.

For example, the image openjdk:8 can be locked down to a specific version using openjdk:8@sha256:d2e5ce9a87c571481197229f618d573d183c6eca1fe3a90ab668ca1d625f0ff9

Installation

Install locally by running:

sudo curl -so /usr/local/bin/locker https://raw.githubusercontent.com/markhobson/locker/master/locker
sudo chmod +x /usr/local/bin/locker

Usage

To lock image references in a Dockerfile:

locker Dockerfile

To unlock image references in a Dockerfile:

locker --unlock Dockerfile

Running tests

The test suite uses Bats. To run the test suite:

1. Pull the images used by the tests:

   docker pull openjdk
   docker pull oracle/openjdk
   docker pull openjdk:8
   

2. Run the tests:

   npx bats test
   

To do

• Use locally built images in tests to avoid having to pull them
• Ignore images that don't exist locally
• Discard digest to allow relocking files
• Recursive syntax to lock all supported files in a directory
• Pull flag to pull newer images before locking
• Support docker-compose.yml
• Support AWS CloudFormation templates