openso/crowdsec-agent
Watch
1
0
Fork
You've already forked crowdsec-agent
 0
Code Issues Pull requests Packages 1 Activity Actions

Pin CrowdSec base by tag and verify yq source by SHA256 #2

Merged
MHE merged 1 commit from review-crowdsec-agent-docker-templates into main 2026-11-01 14:22:00 +01:00
Conversation 0 Commits 1 Files changed 3 +14 -11
MHE commented 2026-11-01 14:17:27 +01:00
Owner
Copy link

What changed

  • Dockerfile, agent stage: FROM now uses crowdsecurity/crowdsec:v1.8.2 instead of the digest pin. A newer CrowdSec release is a new tag.
  • Dockerfile, su-exec stage: FROM now uses alpine:3.24.3 instead of the digest pin.
  • Dockerfile, yq stage: The yq source is downloaded as a release tarball from GitHub and checked with sha256sum against a new YQ_SHA256 build arg, replacing git clone --depth 1 and the git apk package.
  • README.md and AGENTS.md: Docs updated to match. A version bump is now a CrowdSec tag, the Alpine tag, YQ_VERSION, YQ_SHA256, or the module pins.

Why

  • Tags are easier to review and bump than digests, and the docs now describe that workflow.
  • A tarball with a checked SHA256 gives a verifiable yq source without pulling git history at build time, and drops the git package from the build stage.

Review notes

  • The Alpine base in the su-exec stage is now referenced by tag only, so it is no longer immutable. Confirm this matches the intended policy before merging.
  • The YQ_SHA256 value must match the release tarball for v4.50.1.
## What changed - **Dockerfile, agent stage:** `FROM` now uses `crowdsecurity/crowdsec:v1.8.2` instead of the digest pin. A newer CrowdSec release is a new tag. - **Dockerfile, su-exec stage:** `FROM` now uses `alpine:3.24.3` instead of the digest pin. - **Dockerfile, yq stage:** The yq source is downloaded as a release tarball from GitHub and checked with `sha256sum` against a new `YQ_SHA256` build arg, replacing `git clone --depth 1` and the `git` apk package. - **README.md and AGENTS.md:** Docs updated to match. A version bump is now a CrowdSec tag, the Alpine tag, `YQ_VERSION`, `YQ_SHA256`, or the module pins. ## Why - Tags are easier to review and bump than digests, and the docs now describe that workflow. - A tarball with a checked SHA256 gives a verifiable yq source without pulling git history at build time, and drops the `git` package from the build stage. ## Review notes - The Alpine base in the su-exec stage is now referenced by tag only, so it is no longer immutable. Confirm this matches the intended policy before merging. - The `YQ_SHA256` value must match the release tarball for `v4.50.1`.
Pin CrowdSec base by tag and yq source by SHA256
All checks were successful
ci / compose (pull_request) Successful in 12s
Details
ci / shellcheck (pull_request) Successful in 2s
Details
ci / conventions (pull_request) Successful in 2s
Details
ci / image (pull_request) Successful in 1m10s
Details
c3792b8e72
MHE merged commit ba27fd58d8 into main 2026-11-01 14:22:00 +01:00
MHE deleted branch review-crowdsec-agent-docker-templates 2026-11-01 14:22:11 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
openso/crowdsec-agent!2
No description provided.