Pin all docker image versions (#2881)
Remaining unpinned images were in the trusted org and the RBE presubmit
config.
diff --git a/buildkite/update_docker_image_hashes.py b/buildkite/update_docker_image_hashes.py
index d8f0503..ab9be6d 100755
--- a/buildkite/update_docker_image_hashes.py
+++ b/buildkite/update_docker_image_hashes.py
@@ -14,7 +14,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.
"""
-Updates hard-coded Docker image hashes in bazelci.py and Terraform configs.
+Updates hard-coded Docker image hashes in bazelci.py, Terraform configs, and RBE presets.
"""
import concurrent.futures
@@ -163,12 +163,11 @@
f.writelines(output_lines)
-def update_terraform_configs(terraform_dir, image_hashes):
- tf_files = list(terraform_dir.glob("**/*.tf")) + list(terraform_dir.glob("**/*.tpl"))
- pattern = re.compile(r"gcr\.io/bazel-public/([a-zA-Z0-9_\-]+)(?:@sha256:[a-f0-9]+)?")
+def update_pinned_hashes(files, image_hashes):
+ pattern = re.compile(r"gcr\.io/bazel-public/([a-zA-Z0-9_\-]+)@sha256:[a-f0-9]+")
updated_files = []
- for fpath in sorted(tf_files):
+ for fpath in sorted(files):
with open(fpath, "r", encoding="utf-8") as f:
content = f.read()
@@ -188,15 +187,33 @@
return updated_files
+def update_terraform_configs(terraform_dir, image_hashes):
+ tf_files = list(terraform_dir.glob("**/*.tf")) + list(terraform_dir.glob("**/*.tpl"))
+ return update_pinned_hashes(tf_files, image_hashes)
+
+
+def update_rbe_presets(rbe_file, image_hashes):
+ return update_pinned_hashes([rbe_file], image_hashes)
+
+
def main():
repo_root = Path(__file__).resolve().parent.parent
bazelci_path = repo_root / "buildkite" / "bazelci.py"
- terraform_dir = repo_root / "buildkite" / "terraform" / "bazel"
+ terraform_dir = repo_root / "buildkite" / "terraform"
+ rbe_presets_file = repo_root / "rules" / "rbe_presets.json"
if not bazelci_path.exists():
print(f"Error: {bazelci_path} not found.", file=sys.stderr)
sys.exit(1)
+ if not terraform_dir.exists():
+ print(f"Error: {terraform_dir} not found.", file=sys.stderr)
+ sys.exit(1)
+
+ if not rbe_presets_file.exists():
+ print(f"Error: {rbe_presets_file} not found.", file=sys.stderr)
+ sys.exit(1)
+
print("Fetching latest image manifests...")
digests = fetch_all_image_digests(IMAGE_KEYS)
@@ -205,11 +222,14 @@
update_bazelci_file(bazelci_path, new_dict_str)
print(f"Successfully updated IMAGE_HASHES in {bazelci_path}!")
- if terraform_dir.exists():
- updated_tf = update_terraform_configs(terraform_dir, digests)
- print(f"Successfully updated {len(updated_tf)} terraform configuration files:")
- for tf_path in updated_tf:
- print(f" - {tf_path}")
+ updated_tf = update_terraform_configs(terraform_dir, digests)
+ print(f"Successfully updated {len(updated_tf)} terraform configuration files:")
+ for tf_path in updated_tf:
+ print(f" - {tf_path}")
+
+ updated_rbe = update_rbe_presets(rbe_presets_file, digests)
+ if updated_rbe:
+ print(f"Successfully updated RBE presets in {rbe_presets_file}!")
if __name__ == "__main__":
diff --git a/pipelines/bazel-custom-release.yml b/pipelines/bazel-custom-release.yml
index c9a5a9d..e499033 100644
--- a/pipelines/bazel-custom-release.yml
+++ b/pipelines/bazel-custom-release.yml
@@ -10,7 +10,7 @@
- ANDROID_HOME
- ANDROID_NDK_HOME
- BUILDKITE_ARTIFACT_UPLOAD_DESTINATION
- image: gcr.io/bazel-public/ubuntu2404
+ image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c
network: host
privileged: true
propagate-environment: true
diff --git a/pipelines/bazel-release.yml b/pipelines/bazel-release.yml
index a2c7908..cb1859c 100644
--- a/pipelines/bazel-release.yml
+++ b/pipelines/bazel-release.yml
@@ -9,7 +9,7 @@
always-pull: true
environment:
- BUILDKITE_ARTIFACT_UPLOAD_DESTINATION
- image: gcr.io/bazel-public/ubuntu2404
+ image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c
network: host
privileged: true
propagate-environment: true
@@ -439,7 +439,7 @@
always-pull: true
environment:
- BUILDKITE_ARTIFACT_UPLOAD_DESTINATION
- image: gcr.io/bazel-public/ubuntu2404
+ image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c
network: host
privileged: true
propagate-environment: true
diff --git a/pipelines/bazelisk-binaries.yml b/pipelines/bazelisk-binaries.yml
index e965007..402d0c8 100644
--- a/pipelines/bazelisk-binaries.yml
+++ b/pipelines/bazelisk-binaries.yml
@@ -16,7 +16,7 @@
- ANDROID_HOME
- ANDROID_NDK_HOME
- BUILDKITE_ARTIFACT_UPLOAD_DESTINATION
- image: gcr.io/bazel-public/ubuntu2404
+ image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c
network: host
privileged: true
propagate-environment: true
diff --git a/pipelines/bcr-integrity.yml b/pipelines/bcr-integrity.yml
index cb8afcc..cc0e6ab 100644
--- a/pipelines/bcr-integrity.yml
+++ b/pipelines/bcr-integrity.yml
@@ -19,7 +19,7 @@
- ANDROID_HOME
- ANDROID_NDK_HOME
- BUILDKITE_ARTIFACT_UPLOAD_DESTINATION
- image: gcr.io/bazel-public/ubuntu2404
+ image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c
network: host
privileged: true
propagate-environment: true
diff --git a/pipelines/build-embedded-minimized-jdk.yml b/pipelines/build-embedded-minimized-jdk.yml
index 4fca03b..3bbd1f6 100644
--- a/pipelines/build-embedded-minimized-jdk.yml
+++ b/pipelines/build-embedded-minimized-jdk.yml
@@ -15,7 +15,7 @@
- ANDROID_HOME
- ANDROID_NDK_HOME
- BUILDKITE_ARTIFACT_UPLOAD_DESTINATION
- image: gcr.io/bazel-public/ubuntu2404
+ image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c
network: host
privileged: true
propagate-environment: true
diff --git a/pipelines/continuous-integration.yml b/pipelines/continuous-integration.yml
index 5522d5a..fad17db 100644
--- a/pipelines/continuous-integration.yml
+++ b/pipelines/continuous-integration.yml
@@ -10,7 +10,7 @@
- "ANDROID_HOME"
- "ANDROID_NDK_HOME"
- "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
- image: "gcr.io/bazel-public/ubuntu2404"
+ image: "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c"
network: "host"
privileged: true
propagate-environment: true
diff --git a/pipelines/java_tools-rc.yml b/pipelines/java_tools-rc.yml
index 79f7d1f..7f9efb9 100644
--- a/pipelines/java_tools-rc.yml
+++ b/pipelines/java_tools-rc.yml
@@ -35,7 +35,7 @@
- ANDROID_HOME
- ANDROID_NDK_HOME
- BUILDKITE_ARTIFACT_UPLOAD_DESTINATION
- image: gcr.io/bazel-public/ubuntu2404
+ image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c
network: host
privileged: true
propagate-environment: true
diff --git a/pipelines/java_tools-release.yml b/pipelines/java_tools-release.yml
index 7302b49..0e1a41f 100644
--- a/pipelines/java_tools-release.yml
+++ b/pipelines/java_tools-release.yml
@@ -23,7 +23,7 @@
- ANDROID_HOME
- ANDROID_NDK_HOME
- BUILDKITE_ARTIFACT_UPLOAD_DESTINATION
- image: gcr.io/bazel-public/ubuntu2404
+ image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c
network: host
privileged: true
propagate-environment: true
diff --git a/pipelines/publish-bazel-binaries.yml b/pipelines/publish-bazel-binaries.yml
index 6513f2c..bef43b6 100644
--- a/pipelines/publish-bazel-binaries.yml
+++ b/pipelines/publish-bazel-binaries.yml
@@ -12,7 +12,7 @@
- ANDROID_HOME
- ANDROID_NDK_HOME
- BUILDKITE_ARTIFACT_UPLOAD_DESTINATION
- image: gcr.io/bazel-public/ubuntu2404
+ image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c
network: host
privileged: true
propagate-environment: true
diff --git a/pipelines/publish-vm-image.yml b/pipelines/publish-vm-image.yml
index 1971b98..622e0e7 100644
--- a/pipelines/publish-vm-image.yml
+++ b/pipelines/publish-vm-image.yml
@@ -14,7 +14,7 @@
- "ANDROID_HOME"
- "ANDROID_NDK_HOME"
- "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
- image: "gcr.io/bazel-public/ubuntu2204"
+ image: "gcr.io/bazel-public/ubuntu2204@sha256:68494a4921c83f02bb230ce7c24889fb14978f6e492c548a0eaaf13e5fa4f538"
network: "host"
privileged: true
propagate-environment: true
@@ -45,7 +45,7 @@
- "ANDROID_HOME"
- "ANDROID_NDK_HOME"
- "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
- image: "gcr.io/bazel-public/ubuntu2204"
+ image: "gcr.io/bazel-public/ubuntu2204@sha256:68494a4921c83f02bb230ce7c24889fb14978f6e492c548a0eaaf13e5fa4f538"
network: "host"
privileged: true
propagate-environment: true
@@ -80,7 +80,7 @@
- "ANDROID_HOME"
- "ANDROID_NDK_HOME"
- "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
- image: "gcr.io/bazel-public/ubuntu2204"
+ image: "gcr.io/bazel-public/ubuntu2204@sha256:68494a4921c83f02bb230ce7c24889fb14978f6e492c548a0eaaf13e5fa4f538"
network: "host"
privileged: true
propagate-environment: true
@@ -111,7 +111,7 @@
- "ANDROID_HOME"
- "ANDROID_NDK_HOME"
- "BUILDKITE_ARTIFACT_UPLOAD_DESTINATION"
- image: "gcr.io/bazel-public/ubuntu2204"
+ image: "gcr.io/bazel-public/ubuntu2204@sha256:68494a4921c83f02bb230ce7c24889fb14978f6e492c548a0eaaf13e5fa4f538"
network: "host"
privileged: true
propagate-environment: true
diff --git a/pipelines/rules_java-release.yml b/pipelines/rules_java-release.yml
index f4b2011..76d2145 100644
--- a/pipelines/rules_java-release.yml
+++ b/pipelines/rules_java-release.yml
@@ -10,7 +10,7 @@
- ANDROID_HOME
- ANDROID_NDK_HOME
- BUILDKITE_ARTIFACT_UPLOAD_DESTINATION
- image: gcr.io/bazel-public/ubuntu2404
+ image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c
network: host
privileged: true
propagate-environment: true
diff --git a/pipelines/rules_platform-release.yml b/pipelines/rules_platform-release.yml
index 3005e00..158be55 100644
--- a/pipelines/rules_platform-release.yml
+++ b/pipelines/rules_platform-release.yml
@@ -10,7 +10,7 @@
- ANDROID_HOME
- ANDROID_NDK_HOME
- BUILDKITE_ARTIFACT_UPLOAD_DESTINATION
- image: gcr.io/bazel-public/ubuntu2404
+ image: gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c
network: host
privileged: true
propagate-environment: true
diff --git a/rules/rbe_presets.json b/rules/rbe_presets.json
index bf7198e..0f30372 100644
--- a/rules/rbe_presets.json
+++ b/rules/rbe_presets.json
@@ -1,6 +1,6 @@
{
"ubuntu2204": {
- "container": "gcr.io/bazel-public/ubuntu2204:latest",
+ "container": "gcr.io/bazel-public/ubuntu2204@sha256:68494a4921c83f02bb230ce7c24889fb14978f6e492c548a0eaaf13e5fa4f538",
"cpp_env": {
"ABI_LIBC_VERSION": "glibc_2.19",
"ABI_VERSION": "gcc",
@@ -14,7 +14,7 @@
}
},
"ubuntu2404": {
- "container": "gcr.io/bazel-public/ubuntu2404:latest",
+ "container": "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c",
"cpp_env": {
"ABI_LIBC_VERSION": "glibc_2.39",
"ABI_VERSION": "gcc",
@@ -28,7 +28,7 @@
}
},
"ubuntu": {
- "container": "gcr.io/bazel-public/ubuntu2404:latest",
+ "container": "gcr.io/bazel-public/ubuntu2404@sha256:e0a4a1fe658b4fe75f0a6914e7a7891a4976f6fcf12ff143a478a0912ead801c",
"cpp_env": {
"ABI_LIBC_VERSION": "glibc_2.39",
"ABI_VERSION": "gcc",
