chore: optimize and pin container images (#40)

Author: semyonfox

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /api
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /dashboard
+    schedule:
+      interval: weekly

Dockerfile

@@ -1,6 +1,8 @@
-FROM python:3.11-slim
+FROM python:3.13-slim@sha256:6771159cd4fa5d9bba1258caf0b82e6b73458c694d178ad97c5e925c2d0e1a91
 
-RUN apt-get update && apt-get install -y postgresql-client && rm -rf /var/lib/apt/lists/*
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends postgresql-client \
+    && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
@@ -13,10 +15,5 @@ COPY migrations/ ./migrations/
 COPY docker-entrypoint.sh .
 RUN chmod +x docker-entrypoint.sh
 
-ENV POSTGRES_USER=irish_data
-ENV POSTGRES_PASSWORD=secure_password
-ENV POSTGRES_DB=ireland_public
-ENV DATABASE_URL=postgresql://irish_data:secure_password@db:5432/ireland_public
-
 ENTRYPOINT ["./docker-entrypoint.sh"]
 CMD ["python", "daemon.py"]

Jenkinsfile

@@ -11,7 +11,7 @@ pipeline {
   }
 
   environment {
-    DOCKER_BUILDKIT         = '0'
+    DOCKER_BUILDKIT         = '1'
     COMPOSE_PROJECT_NAME    = 'irish-rail-nabber'
     ENV_FILE                = '/home/semyon/jenkins/env/irish-rail-nabber.env'
     CLOUDFLARE_TUNNEL_TOKEN = credentials('cloudflare-tunnel-token')

api/Dockerfile

@@ -1,11 +1,13 @@
-FROM rust:slim AS builder
+FROM rust:1.91-slim@sha256:f75071363e7f4771769d4cf81b1b7b290e607f4d4459e8731f6abdcee9982dc8 AS builder
 WORKDIR /app
-RUN apt-get update && apt-get install -y pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends pkg-config libssl-dev \
+    && rm -rf /var/lib/apt/lists/*
 COPY Cargo.toml Cargo.lock ./
 COPY src/ src/
 RUN cargo build --release
 
-FROM debian:bookworm-slim
+FROM debian:bookworm-slim@sha256:7b140f374b289a7c2befc338f42ebe6441b7ea838a042bbd5acbfca6ec875818
 RUN apt-get update && apt-get install -y ca-certificates curl && rm -rf /var/lib/apt/lists/*
 COPY --from=builder /app/target/release/irish-rail-api /usr/local/bin/
 EXPOSE 8000

dashboard/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-slim AS build
+FROM node:24-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d AS build
 RUN apt-get update \
     && apt-get install -y --no-install-recommends ca-certificates \
     && rm -rf /var/lib/apt/lists/*
@@ -9,7 +9,7 @@ RUN pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build
 
-FROM nginx:alpine
+FROM nginx:1.28-alpine@sha256:a8b39bd9cf0f83869a2162827a0caf6137ddf759d50a171451b335cecc87d236
 COPY --from=build /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 80