chore(deps): Pin dependencies (#5283) [cherry pick]

Dockerfile

@@ -1,18 +1,18 @@
-# syntax=docker/dockerfile:1.4
+# syntax=docker/dockerfile:1.21@sha256:27f9262d43452075f3c410287a2c43f5ef1bf7ec2bb06e8c9eeb1b8d453087bc
 
 # NOTE: This Dockerfile can only be built using BuildKit. BuildKit is used by
 # default when running `docker buildx build` or when DOCKER_BUILDKIT=1 is set
 # in environment variables.
 
-FROM --platform=$BUILDPLATFORM grafana/alloy-build-image:v0.1.28 AS ui-build
+FROM --platform=$BUILDPLATFORM grafana/alloy-build-image:v0.1.28@sha256:982eb27dfc3111a3a81eb605d2e80d0c6c21a32842c2652b6390be6cd80da6fb AS ui-build
 ARG BUILDPLATFORM
 COPY ./internal/web/ui /ui
 WORKDIR /ui
 RUN --mount=type=cache,target=/ui/node_modules,sharing=locked \
     npm install                                               \
     && npm run build
 
-FROM --platform=$BUILDPLATFORM grafana/alloy-build-image:v0.1.28 AS build
+FROM --platform=$BUILDPLATFORM grafana/alloy-build-image:v0.1.28@sha256:982eb27dfc3111a3a81eb605d2e80d0c6c21a32842c2652b6390be6cd80da6fb AS build
 
 ARG BUILDPLATFORM
 ARG TARGETPLATFORM
@@ -39,7 +39,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 
 ###
 
-FROM public.ecr.aws/ubuntu/ubuntu:noble
+FROM public.ecr.aws/ubuntu/ubuntu:noble@sha256:b1940c8ecf8ff591053cc5db0303fb882f9fafec50f26892a870bcbe1b30d25a
 
 # Username and uid for alloy user
 ARG UID="473"

Dockerfile.windows

@@ -1,5 +1,5 @@
-ARG BASE_IMAGE_GO=library/golang:1.24-windowsservercore-ltsc2022
-ARG BASE_IMAGE_WINDOWS=mcr.microsoft.com/windows/nanoserver:ltsc2022
+ARG BASE_IMAGE_GO=library/golang:1.26-windowsservercore-ltsc2022@sha256:8231fbb9b76c4acf94daf580a35ef5a64480e545aded8062fb29deaf456c145f
+ARG BASE_IMAGE_WINDOWS=mcr.microsoft.com/windows/nanoserver:ltsc2022@sha256:60612a30303eb5a15ce7f53fa2eecf70bca41d72657de0482fbde601ae5f3403
 
 FROM ${BASE_IMAGE_GO} AS builder
 

example/docker-compose/images/grizzly/Dockerfile

@@ -1,3 +1,3 @@
-FROM golang:1.25.7-alpine
+FROM golang:1.26.0-alpine@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5
 
 RUN go install github.com/grafana/grizzly/cmd/grr@v0.7.1

example/docker-compose/images/jb/Dockerfile

@@ -1,3 +1,3 @@
-FROM golang:1.25.7-alpine
+FROM golang:1.26.0-alpine@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5
 
 RUN go install github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb@v0.5.1

integration-tests/docker/configs/kafka/Dockerfile

@@ -1,10 +1,10 @@
-FROM golang:1.25.7 as build
+FROM golang:1.26.0@sha256:c83e68f3ebb6943a2904fa66348867d108119890a2c6a2e6f07b38d0eb6c25c5 as build
 WORKDIR /app/
 COPY go.mod go.sum ./
 COPY syntax/go.mod syntax/go.sum ./syntax/
 RUN go mod download
 COPY ./integration-tests/docker/configs/kafka/ ./
 RUN CGO_ENABLED=0 go build -o main main.go
-FROM alpine:3.18
+FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
 COPY --from=build /app/main /app/main
 CMD ["/app/main"]

integration-tests/docker/configs/otel-gen/Dockerfile

@@ -1,10 +1,10 @@
-FROM golang:1.25.7 as build
+FROM golang:1.26.0@sha256:c83e68f3ebb6943a2904fa66348867d108119890a2c6a2e6f07b38d0eb6c25c5 as build
 WORKDIR /app/
 COPY go.mod go.sum ./
 COPY syntax/go.mod syntax/go.sum ./syntax/
 RUN go mod download
 COPY ./integration-tests/docker/configs/otel-gen/ ./
 RUN CGO_ENABLED=0 go build -o main main.go
-FROM alpine:3.18
+FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
 COPY --from=build /app/main /app/main
 CMD ["/app/main"]

integration-tests/docker/configs/prom-gen/Dockerfile

@@ -1,10 +1,10 @@
-FROM golang:1.25.7 as build
+FROM golang:1.26.0@sha256:c83e68f3ebb6943a2904fa66348867d108119890a2c6a2e6f07b38d0eb6c25c5 as build
 WORKDIR /app/
 COPY go.mod go.sum ./
 COPY syntax/go.mod syntax/go.sum ./syntax/
 RUN go mod download
 COPY ./integration-tests/docker/configs/prom-gen/ ./
 RUN CGO_ENABLED=0 go build -o main main.go
-FROM alpine:3.18
+FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
 COPY --from=build /app/main /app/main
 CMD ["/app/main"]

internal/tools/packaging_test/testdata/centos-systemd.Dockerfile

@@ -1,6 +1,6 @@
 # Build a CentOS image with systemd configured to test RPM package installation.
 # See the `test-packages` make target and associated script for how this image is used.
-FROM centos:8
+FROM centos:8@sha256:a27fd8080b517143cbbbab9dfb7c8571c40d67d534bbdee55bd6c473f432b177
 ENV container docker
 RUN (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == \
         systemd-tmpfiles-setup.service ] || rm -f $i; done); \

internal/tools/packaging_test/testdata/debian-systemd.Dockerfile

@@ -1,6 +1,6 @@
 # Build a Debian image with systemd configured to test deb package installation.
 # See the `test-packages` make target and associated script for how this image is used.
-FROM debian:10
+FROM debian:10@sha256:58ce6f1271ae1c8a2006ff7d3e54e9874d839f573d8009c20154ad0f2fb0a225
 ENV container docker
 ENV LC_ALL C
 ENV DEBIAN_FRONTEND noninteractive

tools/build-image/Dockerfile

@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile:1.4
+# syntax=docker/dockerfile:1.21@sha256:27f9262d43452075f3c410287a2c43f5ef1bf7ec2bb06e8c9eeb1b8d453087bc
 
 # NOTE: This Dockerfile can only be built using BuildKit. BuildKit is used by
 # default when running `docker buildx build` or when DOCKER_BUILDKIT=1 is set
@@ -15,18 +15,18 @@ ARG GO_RUNTIME=mustoverride
 #
 
 # Dependency: docker (for building images)
-FROM alpine:3.23 as docker
+FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 as docker
 RUN apk add --no-cache docker-cli docker-cli-buildx
 
 # Dependency: helm
-FROM alpine:3.23 as helm
+FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 as helm
 RUN apk add --no-cache helm
 
 # Dependency: nsis (for building Windows installers)
 # TODO: Use nsis with conda so that we don't have to pull those packages from the internet.
 # https://nsis.sourceforge.io/Conda
 # TODO: Why do we use i386? Is it correct?
-FROM alpine:3.23 as nsis
+FROM alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 as nsis
 RUN wget -nv https://nsis.sourceforge.io/mediawiki/images/4/4a/AccessControl.zip \
  && unzip AccessControl.zip -d /usr/share/nsis/ \
  && mkdir -p /usr/share/nsis/Plugins/x86-unicode \
@@ -55,7 +55,7 @@ RUN go install sigs.k8s.io/controller-tools/cmd/controller-gen@$CONTROLLER_GEN_V
 
 # rfratto/viceroy contains C cross compilers can be used for our Cgo
 # dependencies.
-FROM rfratto/viceroy:v0.4.0
+FROM rfratto/viceroy:v0.4.0@sha256:7e3f328889b5b0c5c0303dda5e74a89189e6e437d33f609dde98f9a84337e0a2
 
 # Fix apt sources - restrict main bullseye to supported architectures
 RUN rm -f /etc/apt/sources.list \

tools/build-image/windows/Dockerfile

@@ -1,4 +1,4 @@
-FROM library/golang:1.25.7-windowsservercore-ltsc2022
+FROM library/golang:1.26.0-windowsservercore-ltsc2022@sha256:8231fbb9b76c4acf94daf580a35ef5a64480e545aded8062fb29deaf456c145f
 
 SHELL ["powershell", "-command"]