Both bases carry a tag and a digest

The runtime base named neither, and BuildKit refuses that at parse time
— reference.ErrObjectRequired, reported as `object required` — before it
opens a socket. It reads like an unreachable registry and is not one,
which is a long way to walk from the message.

Digests pin what the build actually gets; the tags stay so the reference
still says which image it is.

Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
2026-09-08 13:04:38 -07:00
co-authored by Hanzo Dev
parent 32f56cb535
commit eb4afc300c
+6 -2
View File
@@ -1,13 +1,17 @@
# The one Dockerfile in the fabric that pack does not build: pack cannot pack
# itself. The native /v1/runner uses dockerfile.v0 to bootstrap this image, then
# every other repo builds with frontend=gateway.v0 + source=ghcr.io/hanzoai/pack.
FROM golang:1.23-alpine AS build
FROM golang:1.23-alpine@sha256:383395b794dffa5b53012a212365d40c8e37109a626ca30d6151c8348d380b5f AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o /pack .
FROM gcr.io/distroless/static-debian12
# Pinned by digest, and TAGGED: a reference carrying neither tag nor digest is
# refused at parse time by BuildKit — `object required`, from
# reference.ErrObjectRequired — before it opens a socket, so it reads like an
# unreachable registry and is not one. :latest at the time of pinning.
FROM gcr.io/distroless/static-debian12:latest@sha256:d75cdd72874d4790092fcb1b058493ecf6bb5bf2b2b897045b00ff01d91843f2
COPY --from=build /pack /pack
ENTRYPOINT ["/pack"]