From 714645edde9e37e54ae5765710a12588bbd0ddcb Mon Sep 17 00:00:00 2001
From: Jason Wang <7090187+JasonWH@users.noreply.github.com>
Date: Mon, 24 Aug 2026 11:07:21 +0800
Subject: [PATCH] fix(docker): pin base image versions for reproducible builds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- golang:alpine → golang:1.25-alpine (align with go.mod's go 1.25.0)
- alpine:latest → alpine:3.23 (pin runtime base image)

Floating tags make builds non-reproducible and can drift from the
Go version declared in go.mod. Pinning both stages keeps builds
deterministic and reduces supply-chain risk.
---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index c1fceefb5..967275fb6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:alpine AS builder
+FROM golang:1.25-alpine AS builder
 
 ARG RELEASE=false
 ARG COMPRESS=false
@@ -13,7 +13,7 @@ RUN go mod download
 RUN RELEASE=${RELEASE} COMPRESS=${COMPRESS} mage build
 RUN mage -compile ./mage -ldflags "-s -w"
 
-FROM alpine:latest
+FROM alpine:3.23
 
 WORKDIR /openim-server