Follow-up from #1631's review fix: digest-pinning FROM postgres:${PG_MAJOR}-bookworm is structurally broken — when a digest is present, Docker resolves by digest and ignores the tag, so the PG17→18 upgrade drill's --build-arg PG_MAJOR=17 build silently produced a PostgreSQL 18 base (caught because the drill's source container never became ready). The pin was reverted; the postgres base is currently the only non-digest-pinned production base image.
Fix: per-major digest build-args (e.g. PG_DIGEST selected alongside PG_MAJOR, with Renovate regex managers tracking both majors), so the drill's parameterization and digest-pinning coexist.
Done when the default build and the PG_MAJOR=17 drill build are both digest-pinned and the drill passes. Low priority — tag-pinned postgres:18-bookworm with the release-lock digest binding downstream is an acceptable interim.
Follow-up from #1631's review fix: digest-pinning
FROM postgres:${PG_MAJOR}-bookwormis structurally broken — when a digest is present, Docker resolves by digest and ignores the tag, so the PG17→18 upgrade drill's--build-arg PG_MAJOR=17build silently produced a PostgreSQL 18 base (caught because the drill's source container never became ready). The pin was reverted; the postgres base is currently the only non-digest-pinned production base image.Fix: per-major digest build-args (e.g.
PG_DIGESTselected alongsidePG_MAJOR, with Renovate regex managers tracking both majors), so the drill's parameterization and digest-pinning coexist.Done when the default build and the
PG_MAJOR=17drill build are both digest-pinned and the drill passes. Low priority — tag-pinnedpostgres:18-bookwormwith the release-lock digest binding downstream is an acceptable interim.