Skip to content

chore: migrate base images to Chainguard #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sachin-spotdraft wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore: migrate base images to Chainguard #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM python:2.7.11-alpine
FROM --platform=linux/amd64 cgr.dev/spotdraft.com/python-fips:2.7.11-dev

@baz-reviewer baz-reviewer Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI cannot pull private base image

.drone.yml only provides Docker Hub publish credentials, so the publish-docker plugin has no way to authenticate to cgr.dev and pull the private cgr.dev/spotdraft.com/python-fips:2.7.11-dev base image — should we configure base-image registry credentials or authenticate cgr.dev in the pipeline?

Severity web_search

Want Baz to fix this for you? Activate Fixer

Fix in Cursor

Prompt for AI Agents 
Before applying, verify this suggestion against the current code. In the Dockerfile's
`FROM --platform=linux/amd64 cgr.dev/spotdraft.com/python-fips:2.7.11-dev` base image,
the pipeline can't pull the private `cgr.dev` image because Drone's Docker publish
credentials only cover Docker Hub. Refactor `.drone.yml` so the docker plugin
authenticates to `cgr.dev` before evaluating the `FROM` image — add the plugin's base
image registry/username/password (or a secrets-based login), or insert an explicit
`docker login` step for `cgr.dev` using newly added secrets. Verify the `publish-docker`
step succeeds without relying on preconfigured runner state.

MAINTAINER Presslabs ping@presslabs.com

# Ensure that Python outputs everything that's printed inside
Expand Down