What would you like to be added:
The Dockerfile currently uses mutable/floating tags for its base images:
- Dockerfile:4 —
golang:1.26.3 (a version tag, not pinned to an immutable digest)
- Dockerfile:20 —
gcr.io/distroless/static:latest-$ARCH (the latest tag, resolved per-arch)
Both can be pinned to an exact sha256 digest instead of a tag., like following(as of 9 July, 2026)
golang@sha256:2d6c80227255c3112a4d08e67ba98e58efd3846daf15d9d7d4c389565d881b1agcr.io/distroless/static@sha256:d5f030ca7c5793784e9ea4178a116da360250411d13921a5af27c6cb5a5949bf
For gcr.io/distroless/static:latest-$ARCH, there is a multi-arch image, so a single digest-pinned reference (e.g. gcr.io/distroless/static@sha256:) can be used instead of maintaining separate per-arch tags/digests for amd64, arm64, arm, ppc64le, riscv64 and s390x.
arkas1@arkas1-ubuntu-vm:~$ docker buildx imagetools inspect gcr.io/distroless/static@sha256:d5f030ca7c5793784e9ea4178a116da360250411d13921a5af27c6cb5a5949bf
Name: gcr.io/distroless/static@sha256:d5f030ca7c5793784e9ea4178a116da360250411d13921a5af27c6cb5a5949bf
MediaType: application/vnd.oci.image.index.v1+json
Digest: sha256:d5f030ca7c5793784e9ea4178a116da360250411d13921a5af27c6cb5a5949bf
Manifests:
Name: gcr.io/distroless/static@sha256:89a7f06296db723064812805b50f16717e8e4150cdd883e89378e05f410a7b9d
MediaType: application/vnd.oci.image.manifest.v1+json
Platform: linux/amd64
Name: gcr.io/distroless/static@sha256:592ec55eb96a6630b36d1dc2f1ddb7b1f3536c47637b63755a007c5be682e364
MediaType: application/vnd.oci.image.manifest.v1+json
Platform: linux/arm64/v8
Name: gcr.io/distroless/static@sha256:c9e30873e4e28f1d4a048b722b7bacec2e75025ee9cb8d0897de28b0fe910620
MediaType: application/vnd.oci.image.manifest.v1+json
Platform: linux/arm/v7
Name: gcr.io/distroless/static@sha256:76051c83ff1dd24e776df83f0cf20bdb8ba8c6ff36d13af7dd336a3db2f42202
MediaType: application/vnd.oci.image.manifest.v1+json
Platform: linux/s390x
Name: gcr.io/distroless/static@sha256:17e8cc899e6fff228e7ea233cda44b89c7da5b8d5ca8b6bea07012aaf4e6f0da
MediaType: application/vnd.oci.image.manifest.v1+json
Platform: linux/ppc64le
Name: gcr.io/distroless/static@sha256:c7dc0a5f770ba6e07ca8ecade0b23a1b8f5d2e1aa9c0777e95e9153a72f70061
MediaType: application/vnd.oci.image.manifest.v1+json
Platform: linux/riscv64
Why is this needed:
Floating tags like latest and mutable version tags can point to different image content over time, even though the tag name stays the same. This makes builds non-reproducible, the same Dockerfile can produce different results at different times which weakens supply-chain security guarantees, and reliably reproduce any behaviour.
Pinning to a digest ensures every build uses the same base image, which is a baseline expectation for reproducible, verifiable builds.
/kind feature
What would you like to be added:
The Dockerfile currently uses mutable/floating tags for its base images:
golang:1.26.3(a version tag, not pinned to an immutable digest)gcr.io/distroless/static:latest-$ARCH(the latest tag, resolved per-arch)Both can be pinned to an exact sha256 digest instead of a tag., like following(as of 9 July, 2026)
golang@sha256:2d6c80227255c3112a4d08e67ba98e58efd3846daf15d9d7d4c389565d881b1agcr.io/distroless/static@sha256:d5f030ca7c5793784e9ea4178a116da360250411d13921a5af27c6cb5a5949bfFor
gcr.io/distroless/static:latest-$ARCH, there is a multi-arch image, so a single digest-pinned reference (e.g. gcr.io/distroless/static@sha256:) can be used instead of maintaining separate per-arch tags/digests for amd64, arm64, arm, ppc64le, riscv64 and s390x.Why is this needed:
Floating tags like
latestand mutable version tags can point to different image content over time, even though the tag name stays the same. This makes builds non-reproducible, the same Dockerfile can produce different results at different times which weakens supply-chain security guarantees, and reliably reproduce any behaviour.Pinning to a digest ensures every build uses the same base image, which is a baseline expectation for reproducible, verifiable builds.
/kind feature