Add OCI source annotation and custom version annotation to images#2111
Open
joebowbeer wants to merge 1 commit into
Open
Add OCI source annotation and custom version annotation to images#2111joebowbeer wants to merge 1 commit into
joebowbeer wants to merge 1 commit into
Conversation
Loading
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds OCI image annotations to all distroless image types, addressing the version pinning request in #686.
Annotations added:
org.opencontainers.image.source- set to the repository URL (from OS_RELEASE["HOME_URL"] in variables.bzl) on all image types: base, cc, static, python3, nodejs, and javacom.google.distroless.nodejs.version- the specific Node.js archive version (e.g. 24.18.0), per architecturecom.google.distroless.java.version- the specific Temurin JRE/JDK version installedThe
org.opencontainers.image.sourceannotation is the most essential annotation to add, perhttps://snyk.io/blog/how-and-when-to-use-docker-labels-oci-container-annotations/
The Java and NodeJS images are the only images where it makes sense to add a separate version annotation, and for these I think a custom namespace (
com.google.distroless) is needed.More annotations can be added later as needed.
Implementation notes for NodeJS versioning:
Rather than adding a static NODEJS_VERSIONS dict to config.bzl, a new node_versions_repo repository rule is generated by the existing node module extension in node.bzl. This creates an @node_versions//:versions.bzl file that nodejs.bzl loads at analysis time - the same pattern used for Debian package versions. The update_node_archives.js script is updated to regenerate the node_versions_repo() call alongside the existing node_archive() calls, so there is no version data to keep in sync manually.
Closes #686