Description
Dockerfile.mongodb starts FROM mongo:latest, while Dockerfile.api pins both of its bases by sha256 digest through ARG RUST_BASE_DIGEST / ARG PYTHON_BASE_DIGEST, with a comment documenting how to refresh them:
# docker pull rust:1.88-slim-bookworm
# docker inspect --format='{{index .RepoDigests 0}}' rust:1.88-slim-bookwormMotivation
The local development database silently tracks whatever MongoDB currently ships. A breaking major release lands on every developer's next make mongodb with no change to the repository and nothing in git to explain it, and two developers on the same commit can be running different server versions.
The inconsistency also undercuts the reasoning already written down in Dockerfile.api: that comment exists because a tip retag at Docker Hub should not be able to swap a build base out from under the project. The same argument applies here.
Expected Outcome
Dockerfile.mongodb pins an explicit MongoDB version and a sha256 digest, following the ARG …_DIGEST convention and refresh comment already established in Dockerfile.api. Bumping it becomes a visible commit.
Choosing the version is the substantive part of the work rather than an afterthought: mongo:latest currently resolves to MongoDB 8, and docker-compose/deployment configs elsewhere in the repo should be checked for what they assume before a version is fixed here.
Description
Dockerfile.mongodbstartsFROM mongo:latest, whileDockerfile.apipins both of its bases by sha256 digest throughARG RUST_BASE_DIGEST/ARG PYTHON_BASE_DIGEST, with a comment documenting how to refresh them:Motivation
The local development database silently tracks whatever MongoDB currently ships. A breaking major release lands on every developer's next
make mongodbwith no change to the repository and nothing in git to explain it, and two developers on the same commit can be running different server versions.The inconsistency also undercuts the reasoning already written down in
Dockerfile.api: that comment exists because a tip retag at Docker Hub should not be able to swap a build base out from under the project. The same argument applies here.Expected Outcome
Dockerfile.mongodbpins an explicit MongoDB version and a sha256 digest, following theARG …_DIGESTconvention and refresh comment already established inDockerfile.api. Bumping it becomes a visible commit.Choosing the version is the substantive part of the work rather than an afterthought:
mongo:latestcurrently resolves to MongoDB 8, anddocker-compose/deployment configs elsewhere in the repo should be checked for what they assume before a version is fixed here.