Pin dependencies (dev)

Dockerfile

@@ -1,4 +1,4 @@
-FROM public.ecr.aws/docker/library/node:26-alpine AS web
+FROM public.ecr.aws/docker/library/node:26-alpine@sha256:e88a35be04478413b7c71c455cd9865de9b9360e1f43456be5951032d7ac1a66 AS web
 
 WORKDIR /app
 COPY web/package.json web/pnpm-lock.yaml web/pnpm-workspace.yaml ./
@@ -7,7 +7,7 @@ RUN pnpm install --ignore-scripts --frozen-lockfile
 COPY web/ .
 RUN pnpm build
 
-FROM public.ecr.aws/docker/library/rust:1 AS chef
+FROM public.ecr.aws/docker/library/rust:1@sha256:1f0dbad1df66647807e6952d1db85d0b2bda7606cb2139d82517e4f009967376 AS chef
 
 WORKDIR /build
 
@@ -46,7 +46,7 @@ COPY migrations migrations
 RUN cargo install --locked --bin defguard --path ./crates/defguard --root /build
 
 # run
-FROM public.ecr.aws/docker/library/debian:13-slim
+FROM public.ecr.aws/docker/library/debian:13-slim@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2
 # TEMPORARY FIX: The parent image has a snapshot of debian sources that has a security vulnerability. This is a temporary fix until the parent image is updated.
 # Remove this once the parent image is updated with the latest debian sources.
 RUN sed -i \

Dockerfile.device

@@ -1,4 +1,4 @@
-FROM alpine:3
+FROM alpine:3@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 RUN apk add wireguard-tools && echo wireguard >> /etc/modules
 RUN printf "[Interface]\n\

Dockerfile.ldap

@@ -1,3 +1,3 @@
-FROM osixia/openldap:1.5.0 as runtime
+FROM osixia/openldap:1.5.0@sha256:18742e9c449c9c1afe129d3f2f3ee15fb34cc43e5f940a20f3399728f41d7c28 as runtime
 # load ldifs
 COPY ./ldif /container/service/slapd/assets/config/bootstrap/ldif/custom

docker-compose.e2e-auto-adoption.yaml

@@ -21,7 +21,7 @@ services:
       - db
 
   db:
-    image: public.ecr.aws/docker/library/postgres:11-alpine
+    image: public.ecr.aws/docker/library/postgres:11-alpine@sha256:ea50b9fd617b66c9135816a4536cf6e0697d4eea7014a7194479c95f6edd5ef9
     environment:
       POSTGRES_DB: defguard
       POSTGRES_USER: defguard

docker-compose.e2e.yaml

@@ -21,7 +21,7 @@ services:
       - db
 
   db:
-    image: public.ecr.aws/docker/library/postgres:11-alpine
+    image: public.ecr.aws/docker/library/postgres:11-alpine@sha256:ea50b9fd617b66c9135816a4536cf6e0697d4eea7014a7194479c95f6edd5ef9
     environment:
       POSTGRES_DB: defguard
       POSTGRES_USER: defguard

docker-compose.ldap-test.yaml

@@ -4,7 +4,7 @@
 # Used by `just test-ldap` (locally) and the test-ldap CI job.
 services:
   db:
-    image: public.ecr.aws/docker/library/postgres:17-alpine
+    image: public.ecr.aws/docker/library/postgres:17-alpine@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193
     environment:
       POSTGRES_DB: defguard
       POSTGRES_USER: defguard

docker-compose.ldap.yaml

@@ -32,7 +32,7 @@ services:
       - NET_ADMIN
 
   db:
-    image: postgres:17-alpine
+    image: postgres:17-alpine@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193
     environment:
       POSTGRES_DB: defguard
       POSTGRES_USER: defguard
@@ -66,7 +66,7 @@ services:
   #     - ./configs/logstash.conf:/usr/share/logstash/pipeline/logstash.conf:ro
 
   openldap:
-    image: bitnamilegacy/openldap:2.6
+    image: bitnamilegacy/openldap:2.6@sha256:687f14a22b5c74fb057a57221acdbe7b8c82e2d3619fc380db3af48ec4aa04ed
     user: root
     restart: unless-stopped
     environment:

docker-compose.yaml

@@ -41,7 +41,7 @@ services:
       RUST_BACKTRACE: 1
 
   db:
-    image: postgres:17-alpine
+    image: postgres:17-alpine@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193
     environment:
       POSTGRES_DB: defguard
       POSTGRES_USER: defguard