Skip to content

fix: use unpinned tags in Dockerfile.distroless per code review

c2444a0
Select commit
Loading
Failed to load commit list.
Merged

TT-16964 - remove sbom job from release workflow #962

fix: use unpinned tags in Dockerfile.distroless per code review
c2444a0
Select commit
Loading
Failed to load commit list.
probelabs / Visor: performance succeeded Apr 14, 2026 in 36s

✅ Check Passed (Warnings Found)

performance check passed. Found 1 warning, but fail_if condition was not met.

Details

📊 Summary

  • Total Issues: 1
  • Warning Issues: 1

🔍 Failure Condition Results

Passed Conditions

  • global_fail_if: Condition passed

Issues by Category

Performance (1)

  • ⚠️ ci/Dockerfile.distroless:3 - Base images in the Dockerfile are specified using floating tags (debian:trixie-slim on line 3 and gcr.io/distroless/static-debian12:nonroot on line 12) instead of pinned digests. While this change was necessary to enable multi-architecture builds, it can degrade build performance. Using floating tags can lead to build cache misses if the base image is updated, as Docker will pull the new version and rebuild subsequent layers. This increases build times and makes builds non-deterministic.

Powered by Visor from Probelabs

💡 TIP: You can chat with Visor using /visor ask <your question>

Annotations

Check warning on line 12 in ci/Dockerfile.distroless

See this annotation in the file changed.

@probelabs probelabs / Visor: performance

performance Issue

Base images in the Dockerfile are specified using floating tags (`debian:trixie-slim` on line 3 and `gcr.io/distroless/static-debian12:nonroot` on line 12) instead of pinned digests. While this change was necessary to enable multi-architecture builds, it can degrade build performance. Using floating tags can lead to build cache misses if the base image is updated, as Docker will pull the new version and rebuild subsequent layers. This increases build times and makes builds non-deterministic.
Raw output
To improve build performance and ensure reproducibility, pin the base images to their multi-platform manifest list digest. This provides the required multi-architecture support while guaranteeing that the build cache is leveraged effectively. You can obtain the correct digest by running `docker buildx imagetools inspect <image>:<tag>`.