mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-07 04:12:04 +00:00
Marc-André Bombeck
b6b693717c
The runner moves from Wolfi to node:22-trixie-slim, the same image and digest as the dependency and build stages. Wolfi's free repository keeps only its newest Node stream current, so nodejs-22 stayed at 22.23.2 and missed two releases with HIGH fixes; the official image carries 22.23.4. The runner removes npm, npx, corepack and yarn before anything else and fails the build if one is left. The Prisma CLI install moves to its own prisma-cli stage on the same base and is copied over, so npm never runs in the runner. pg_dump and pg_restore 18.6 come from a pgclient stage on postgres:18.6-trixie, pinned by digest, with the libpq they link; the Kerberos, LDAP and SASL libraries come from apt. The PGDG package would bring Perl and the wrapper scripts, and its repository drops a pinned minor once the next one is out. The native ABI and glibc check between builder and runner stays as a guard. runtime-package-pins now holds every stage to a digest, the runner to the builder's image, the runner free of package managers, and the pgclient minor to the bundled database's. Dependabot ignores a PostgreSQL major in the Dockerfile as it does in the compose file.