Skip to content

chore: harden Dockerfiles and add devops CODEOWNERS #487

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mpastecki wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore: harden Dockerfiles and add devops CODEOWNERS #487

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
64036b3
chore: harden Dockerfiles and add devops CODEOWNERS
mpastecki Feb 5, 2026
20ba049
chore: scope CODEOWNERS devops ownership to workflows only
mpastecki Feb 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,4 @@
* @jrwbabylonlab @jeremy-babylonlabs @kirugan
* @jrwbabylonlab @jeremy-babylonlabs @kirugan

# DevOps team owns CI/CD workflows
/.github/workflows/ @babylonlabs-io/devops
5 changes: 3 additions & 2 deletions contrib/images/staking-api-service/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

ARG VERSION="HEAD"

Copy link

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A hadolint ignore directive for DL3018 (pin versions in apk add) has been added to the builder stage, which contradicts the PR's goal of hardening Dockerfiles by pinning package versions. While build tools often don't need pinned versions since the image is ephemeral, for consistency with the runtime stage and the PR's stated objectives, consider either pinning these build dependencies or adding a comment explaining why pinning is not necessary for the builder stage.

Suggested change
# Builder image is ephemeral and not shipped to production; build tools are intentionally left
# unpinned here to simplify maintenance. DL3018 is ignored only for this builder stage.

Copilot uses AI. Check for mistakes.
# hadolint ignore=DL3018
RUN apk add --no-cache \
make \
git \
Expand Down Expand Up @@ -31,13 +32,13 @@
make build

# Final minimal image with binary only
FROM alpine:3.16 AS run
FROM alpine:3.21 AS run

Copy link

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to the PR description, this change aims to apply hadolint best practices including the SHELL pipefail directive. However, the SHELL directive with pipefail is missing from the runtime stage. Consider adding SHELL ["/bin/sh", "-o", "pipefail", "-c"] before the RUN commands to ensure pipefail is enabled for safer script execution.

Suggested change
SHELL ["/bin/sh", "-o", "pipefail", "-c"]

Copilot uses AI. Check for mistakes.
RUN addgroup --gid 1138 -S staking-api-service && adduser --uid 1138 -S staking-api-service -G staking-api-service
RUN apk add bash curl jq
RUN apk add --no-cache bash=5.2.37-r0 curl=8.14.1-r2 jq=1.7.1-r0
Copy link

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description mentions "Pin Debian runtime packages to exact versions (bookworm) where applicable" but no Debian-based Dockerfiles are present in the repository or modified in this PR. Only Alpine-based Dockerfiles exist. Consider updating the PR description to accurately reflect that only Alpine packages are being pinned, or clarify what "where applicable" means in this context.

Copilot uses AI. Check for mistakes.

# Label should match your github repo
LABEL org.opencontainers.image.source="https://github.com/babylonlabs-io/staking-api-service:${VERSION}"

Check warning on line 41 in contrib/images/staking-api-service/Dockerfile

View workflow job for this annotation

GitHub Actions / docker_pipeline / docker_build (linux/arm64, ubuntu-24.04-arm64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 41 in contrib/images/staking-api-service/Dockerfile

View workflow job for this annotation

GitHub Actions / docker_pipeline / docker_build (linux/arm64, ubuntu-24.04-arm64)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 41 in contrib/images/staking-api-service/Dockerfile

View workflow job for this annotation

GitHub Actions / docker_pipeline / docker_build (linux/amd64, ubuntu-24.04)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/

Check warning on line 41 in contrib/images/staking-api-service/Dockerfile

View workflow job for this annotation

GitHub Actions / docker_pipeline / docker_build (linux/amd64, ubuntu-24.04)

Variables should be defined before their use 

UndefinedVar: Usage of undefined variable '$VERSION'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/


# Copy over binaries from the build-env
Expand Down
Loading