Repository navigation
[FEAT] Sub-command for locking/pinning images to digests with lock-file support for the compose command in general #12836
Description
Description
Currently, if one wants to ensure supply-chain security with regards to use of docker images in docker-compose files, users have to specify the digest manually in the compose file.
Previously there was a project (docker-lock) that could automate this, but this project has been deleted.
It would be great if docker-compose supported pinning images to digest, somewhat like npm lock-files, python lock-files and go sum-file.
If docker-compose could also support updating said images digest upon request, that would be great too, but that would not be necessary for a Minimal Viable Product version of the feature IMO, as long as i can request a "re-lock" from compose that updates the digests in the assumed new lock-file, when I have updated the tag in the compose-file
Activity
[-][FEAT] Support locking/pinning images to digests[/-][+][FEAT] Sub-command locking/pinning images to digests with lock-file support for the compose command in general[/+][-][FEAT] Sub-command locking/pinning images to digests with lock-file support for the compose command in general[/-][+][FEAT] Sub-command for locking/pinning images to digests with lock-file support for the compose command in general[/+]ndeloof commentedon May 16, 2025
You can rely on
docker compose config --resolve-image-digeststo fix image digest.Then som yq trickery can be used to generate an override file that will only contain the image references
This feature is actually already implemented in Docker Compose for the benefits of the
publishcommand, so maybe we could expose it asdocker compose config --image-digestsandoks commentedon Sep 24, 2025
Relates to #5818