cartesi · endersonmaia · Oct 28, 2025 · Oct 28, 2025 · Oct 28, 2025 · Oct 28, 2025
diff --git a/apps/cli/src/commands/run.ts b/apps/cli/src/commands/run.ts
@@ -10,7 +10,7 @@ import getPort, { portNumbers } from "get-port";
 import ora from "ora";
 import { type Address, type Hex, numberToHex } from "viem";
 import { getMachineHash, getProjectName } from "../base.js";
-import { DEFAULT_SDK_VERSION, PREFERRED_PORT } from "../config.js";
+import { PREFERRED_PORT } from "../config.js";
 import {
     AVAILABLE_SERVICES,
     type RollupsDeployment,
@@ -206,7 +206,7 @@ export const createRunCommand = () => {
                 "--runtime-version <version>",
                 "version for Cartesi Rollups Runtime to use",
             )
-                .default(DEFAULT_SDK_VERSION)
+                .default(undefined)
                 .hideHelp(),
         )
         .option(

diff --git a/apps/cli/src/compose/docker-compose-database.yaml b/apps/cli/src/compose/docker-compose-database.yaml
@@ -1,6 +1,6 @@
 services:
     database:
-        image: cartesi/rollups-database:${CARTESI_SDK_VERSION}
+        image: ${CARTESI_SDK_DATABASE_IMAGE}
         healthcheck:
             test: ["CMD-SHELL", "pg_isready -U postgres || exit 1"]
             start_period: 10s

diff --git a/apps/cli/src/compose/docker-compose-explorer.yaml b/apps/cli/src/compose/docker-compose-explorer.yaml
@@ -39,7 +39,7 @@ configs:
 
 services:
     explorer_api:
-        image: cartesi/rollups-explorer-api:1.0.0
+        image: docker.io/cartesi/rollups-explorer-api:1.0.0@sha256:2a0bd852dd811033eccc714bcfc6e98af16838de35b79ad06bdce115bbea6a66
         environment:
             <<: *explorer_db_env
             GQL_PORT: 4350
@@ -65,7 +65,7 @@ services:
                 condition: service_healthy
 
     squid_processor:
-        image: cartesi/rollups-explorer-api:1.0.0
+        image: docker.io/cartesi/rollups-explorer-api:1.0.0@sha256:2a0bd852dd811033eccc714bcfc6e98af16838de35b79ad06bdce115bbea6a66
         environment:
             <<: *explorer_db_env
             CHAIN_IDS: ${CARTESI_BLOCKCHAIN_ID:-13370}
@@ -78,7 +78,7 @@ services:
                 condition: service_healthy
 
     explorer:
-        image: cartesi/rollups-explorer:1.3.3
+        image: docker.io/cartesi/rollups-explorer:1.3.3@sha256:20f7787f055f3a96fe7c44cd654662aa4effb7a8fc7a632ccc5306fdd87d7424
         environment:
             NODE_RPC_URL: "http://127.0.0.1:${CARTESI_LISTEN_PORT:-6751}/anvil"
             EXPLORER_API_URL: "http://127.0.0.1:${CARTESI_LISTEN_PORT:-6751}/explorer-api/graphql"

diff --git a/apps/cli/src/compose/docker-compose-node.yaml b/apps/cli/src/compose/docker-compose-node.yaml
@@ -21,7 +21,7 @@ configs:
 
 services:
     rollups-node:
-        image: cartesi/rollups-runtime:${CARTESI_SDK_VERSION}
+        image: ${CARTESI_SDK_RUNTIME_IMAGE}
         depends_on:
             database:
                 condition: service_healthy

diff --git a/apps/cli/src/compose/docker-compose-proxy.yaml b/apps/cli/src/compose/docker-compose-proxy.yaml
@@ -1,6 +1,6 @@
 services:
     proxy:
-        image: traefik:v3.3.4
+        image: docker.io/traefik:v3.5.4@sha256:fa528d4565c8c279328c12d466325ee0f65804a75bcdbef737290664ad971d68
         healthcheck:
             test: ["CMD", "traefik", "healthcheck", "--ping"]
             start_period: 10s

diff --git a/apps/cli/src/config.ts b/apps/cli/src/config.ts
@@ -73,8 +73,21 @@ export class InvalidStringArrayError extends Error {
  */
 const DEFAULT_FORMAT = "ext2";
 const DEFAULT_RAM = "128Mi";
+
+/**
+ * Default SDK container image information
+ */
 export const DEFAULT_SDK_VERSION = "0.12.0-alpha.25";
-export const DEFAULT_SDK_IMAGE = "cartesi/sdk";
+export const DEFAULT_SDK_IMAGE_NAME = "docker.io/cartesi/sdk";
+export const DEFAULT_SDK_IMAGE_TAG = DEFAULT_SDK_VERSION;
+export const DEFAULT_SDK_IMAGE_SHA256_DIGEST = "406e35fdabf189be2ffc3b47c23ad31b4864cf24f012db01e04d6b254e1e57f4"
+export const DEFAULT_SDK_DATABASE_IMAGE_NAME = "docker.io/cartesi/rollups-database";
+export const DEFAULT_SDK_DATABASE_IMAGE_TAG = DEFAULT_SDK_VERSION;
+export const DEFAULT_SDK_DATABASE_IMAGE_SHA256_DIGEST = "b179de07c32894407e3e1eff060899a462d31d4fe6892e0f075daff74f83ebd9"
+export const DEFAULT_SDK_RUNTIME_IMAGE_NAME = "docker.io/cartesi/rollups-runtime";
+export const DEFAULT_SDK_RUNTIME_IMAGE_TAG = DEFAULT_SDK_VERSION;
+export const DEFAULT_SDK_RUNTIME_IMAGE_SHA256_DIGEST = "6b198f746762f93d61e2c127628e0c92b4424d2ff7c2f9161c8a47c04ab407f4"
+
 export const PREFERRED_PORT = 6751;
 
 type Builder = "directory" | "docker" | "empty" | "none" | "tar";
@@ -185,7 +198,7 @@ export const defaultMachineConfig = (): MachineConfig => ({
 export const defaultConfig = (): Config => ({
     drives: { root: defaultRootDriveConfig() },
     machine: defaultMachineConfig(),
-    sdk: `${DEFAULT_SDK_IMAGE}:${DEFAULT_SDK_VERSION}`,
+    sdk: `${DEFAULT_SDK_IMAGE_NAME}:${DEFAULT_SDK_IMAGE_TAG}`,
 });
 
 const parseBoolean = (value: TomlPrimitive, defaultValue: boolean): boolean => {
@@ -506,7 +519,7 @@ export const parse = (str: string[]): Config => {
         machine: parseMachine(toml.machine),
         sdk: parseString(
             toml.sdk,
-            `${DEFAULT_SDK_IMAGE}:${DEFAULT_SDK_VERSION}`,
+            `${DEFAULT_SDK_IMAGE_NAME}:${DEFAULT_SDK_IMAGE_TAG}`,
         ),
     };
 

diff --git a/apps/cli/src/exec/rollups.ts b/apps/cli/src/exec/rollups.ts
@@ -16,7 +16,17 @@ import {
     getProjectName,
     getServiceHealth,
 } from "../base.js";
-import { DEFAULT_SDK_IMAGE } from "../config.js";
+import {
+    DEFAULT_SDK_DATABASE_IMAGE_NAME,
+    DEFAULT_SDK_DATABASE_IMAGE_SHA256_DIGEST,
+    DEFAULT_SDK_DATABASE_IMAGE_TAG,
+    DEFAULT_SDK_IMAGE_NAME,
+    DEFAULT_SDK_IMAGE_SHA256_DIGEST,
+    DEFAULT_SDK_IMAGE_TAG,
+    DEFAULT_SDK_RUNTIME_IMAGE_NAME,
+    DEFAULT_SDK_RUNTIME_IMAGE_SHA256_DIGEST,
+    DEFAULT_SDK_RUNTIME_IMAGE_TAG,
+} from "../config.js";
 
 export type RollupsDeployment = {
     name: string;
@@ -230,7 +240,7 @@ export const startEnvironment = async (options: {
     memory?: number;
     port: number;
     projectName: string;
-    runtimeVersion: string;
+    runtimeVersion: string | undefined;
     services: string[];
     verbose: boolean;
 }) => {
@@ -255,6 +265,20 @@ export const startEnvironment = async (options: {
         "..",
     );
 
+    // determine sdk images
+    // prefer pinned digests when runtime version is not specified
+    const sdkImage = runtimeVersion
+        ? `${DEFAULT_SDK_IMAGE_NAME}:${runtimeVersion}`
+        : `${DEFAULT_SDK_IMAGE_NAME}:${DEFAULT_SDK_IMAGE_TAG}@sha256:${DEFAULT_SDK_IMAGE_SHA256_DIGEST}`;
+
+    const sdkDatabaseImage = runtimeVersion
+        ? `${DEFAULT_SDK_DATABASE_IMAGE_NAME}:${runtimeVersion}`
+        : `${DEFAULT_SDK_DATABASE_IMAGE_NAME}:${DEFAULT_SDK_DATABASE_IMAGE_TAG}@sha256:${DEFAULT_SDK_DATABASE_IMAGE_SHA256_DIGEST}`;
+
+    const sdkRuntimeImage = runtimeVersion
+        ? `${DEFAULT_SDK_RUNTIME_IMAGE_NAME}:${runtimeVersion}`
+        : `${DEFAULT_SDK_RUNTIME_IMAGE_NAME}:${DEFAULT_SDK_RUNTIME_IMAGE_TAG}@sha256:${DEFAULT_SDK_RUNTIME_IMAGE_SHA256_DIGEST}`;
+
     // setup the environment variable used in docker compose
     const env: NodeJS.ProcessEnv = {
         CARTESI_BIN_PATH: binPath,
@@ -264,8 +288,9 @@ export const startEnvironment = async (options: {
         CARTESI_LOG_LEVEL: verbose ? "debug" : "info",
         CARTESI_ROLLUPS_NODE_CPUS: cpus?.toString(),
         CARTESI_ROLLUPS_NODE_MEMORY: memory?.toString(),
-        CARTESI_SDK_IMAGE: `${DEFAULT_SDK_IMAGE}:${runtimeVersion}`,
-        CARTESI_SDK_VERSION: runtimeVersion,
+        CARTESI_SDK_IMAGE: sdkImage,
+        CARTESI_SDK_DATABASE_IMAGE: sdkDatabaseImage,
+        CARTESI_SDK_RUNTIME_IMAGE: sdkRuntimeImage,
     };
 
     // build a list of unique compose files