diff --git a/services/account-service/Dockerfile b/services/account-service/Dockerfile index 793dea1..b5b18fb 100644 --- a/services/account-service/Dockerfile +++ b/services/account-service/Dockerfile @@ -1,6 +1,6 @@ # Base pinned by digest so a rebuild of an old commit produces the same image. # Dependabot (docker ecosystem) proposes digest bumps; nothing floats silently. -FROM eclipse-temurin:21-jre-alpine@sha256:3f08b13888f595cc49edabea7250ba69499ba25602b267da591720769400e08c +FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0 # Runs as an unprivileged uid: the jar needs no write access outside /tmp. RUN addgroup -S finix && adduser -S -u 10001 -G finix finix diff --git a/services/compliance-service/Dockerfile b/services/compliance-service/Dockerfile index 00c545d..bd4560c 100644 --- a/services/compliance-service/Dockerfile +++ b/services/compliance-service/Dockerfile @@ -1,6 +1,6 @@ # Base pinned by digest so a rebuild of an old commit produces the same image. # Dependabot (docker ecosystem) proposes digest bumps; nothing floats silently. -FROM eclipse-temurin:21-jre-alpine@sha256:3f08b13888f595cc49edabea7250ba69499ba25602b267da591720769400e08c +FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0 # Runs as an unprivileged uid: the jar needs no write access outside /tmp. RUN addgroup -S finix && adduser -S -u 10001 -G finix finix diff --git a/services/enclave-runtime/Dockerfile b/services/enclave-runtime/Dockerfile index 2ced051..29aca00 100644 --- a/services/enclave-runtime/Dockerfile +++ b/services/enclave-runtime/Dockerfile @@ -9,7 +9,7 @@ # Do not add shells, curl, package managers, or debug aids to this image. The # HEALTHCHECK installs nothing: it calls the busybox wget the base already # ships, against the only endpoint this service exposes. -FROM eclipse-temurin:21-jre-alpine@sha256:3f08b13888f595cc49edabea7250ba69499ba25602b267da591720769400e08c +FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0 RUN addgroup -S finix && adduser -S -u 10001 -G finix finix WORKDIR /app diff --git a/services/identity-service/Dockerfile b/services/identity-service/Dockerfile index 0e5c1bc..28237c4 100644 --- a/services/identity-service/Dockerfile +++ b/services/identity-service/Dockerfile @@ -1,6 +1,6 @@ # Base pinned by digest so a rebuild of an old commit produces the same image. # Dependabot (docker ecosystem) proposes digest bumps; nothing floats silently. -FROM eclipse-temurin:21-jre-alpine@sha256:3f08b13888f595cc49edabea7250ba69499ba25602b267da591720769400e08c +FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0 # Runs as an unprivileged uid: the jar needs no write access outside /tmp. RUN addgroup -S finix && adduser -S -u 10001 -G finix finix diff --git a/services/ledger-service/Dockerfile b/services/ledger-service/Dockerfile index 7a46041..92a15a4 100644 --- a/services/ledger-service/Dockerfile +++ b/services/ledger-service/Dockerfile @@ -1,6 +1,6 @@ # Base pinned by digest so a rebuild of an old commit produces the same image. # Dependabot (docker ecosystem) proposes digest bumps; nothing floats silently. -FROM eclipse-temurin:21-jre-alpine@sha256:3f08b13888f595cc49edabea7250ba69499ba25602b267da591720769400e08c +FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0 # Runs as an unprivileged uid: the jar needs no write access outside /tmp. RUN addgroup -S finix && adduser -S -u 10001 -G finix finix diff --git a/services/loan-service/Dockerfile b/services/loan-service/Dockerfile index 5d66164..560bbb4 100644 --- a/services/loan-service/Dockerfile +++ b/services/loan-service/Dockerfile @@ -1,6 +1,6 @@ # Base pinned by digest so a rebuild of an old commit produces the same image. # Dependabot (docker ecosystem) proposes digest bumps; nothing floats silently. -FROM eclipse-temurin:21-jre-alpine@sha256:3f08b13888f595cc49edabea7250ba69499ba25602b267da591720769400e08c +FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0 # Runs as an unprivileged uid: the jar needs no write access outside /tmp. RUN addgroup -S finix && adduser -S -u 10001 -G finix finix diff --git a/services/notification-service/Dockerfile b/services/notification-service/Dockerfile index 8130f40..d84db95 100644 --- a/services/notification-service/Dockerfile +++ b/services/notification-service/Dockerfile @@ -2,14 +2,14 @@ # Build from repo root: # docker build -f services/notification-service/Dockerfile -t finix-notification-service . -FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS deps +FROM node:26-alpine@sha256:aadf416b2cdce311a8811ba3f0608a61b77dbf997500e2eafe781b51f6a0b019 AS deps WORKDIR /app # npm ci (not install) so the image is built from the committed lockfile — # same dependency tree here, in CI and on a contributor's machine. COPY services/notification-service/package.json services/notification-service/package-lock.json ./ RUN npm ci --omit=dev -FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 +FROM node:26-alpine@sha256:aadf416b2cdce311a8811ba3f0608a61b77dbf997500e2eafe781b51f6a0b019 WORKDIR /app RUN adduser -D -H -u 10001 finix COPY --from=deps /app/node_modules ./node_modules diff --git a/services/payment-hub/Dockerfile b/services/payment-hub/Dockerfile index ad47a97..54b3e27 100644 --- a/services/payment-hub/Dockerfile +++ b/services/payment-hub/Dockerfile @@ -5,7 +5,7 @@ # Tracks the `go` directive in go.mod (1.25). A builder older than that makes # the toolchain download a second Go at build time — slow, and impossible in an # air-gapped build. -FROM golang:1.25-alpine@sha256:56961d79ea8129efddcc0b8643fd8a5416b4e6228cfd477e3fd61deb2672c587 AS build +FROM golang:1.26-alpine@sha256:0178a641fbb4858c5f1b48e34bdaabe0350a330a1b1149aabd498d0699ff5fb2 AS build WORKDIR /src RUN apk add --no-cache git ca-certificates COPY services/payment-hub/go.mod services/payment-hub/go.sum* ./ @@ -13,7 +13,7 @@ RUN go mod download COPY services/payment-hub/ ./ RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags="-s -w" -o /out/payment-hub . -FROM alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc +FROM alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b RUN apk add --no-cache ca-certificates tzdata \ && adduser -D -H -u 10001 finix WORKDIR /app diff --git a/services/transaction-orchestrator/Dockerfile b/services/transaction-orchestrator/Dockerfile index 4b6191e..db2b0cc 100644 --- a/services/transaction-orchestrator/Dockerfile +++ b/services/transaction-orchestrator/Dockerfile @@ -1,6 +1,6 @@ # Base pinned by digest so a rebuild of an old commit produces the same image. # Dependabot (docker ecosystem) proposes digest bumps; nothing floats silently. -FROM eclipse-temurin:21-jre-alpine@sha256:3f08b13888f595cc49edabea7250ba69499ba25602b267da591720769400e08c +FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0 # Runs as an unprivileged uid: the jar needs no write access outside /tmp. RUN addgroup -S finix && adduser -S -u 10001 -G finix finix diff --git a/services/ussd-gateway/Dockerfile b/services/ussd-gateway/Dockerfile index a33a262..7ace593 100644 --- a/services/ussd-gateway/Dockerfile +++ b/services/ussd-gateway/Dockerfile @@ -1,6 +1,6 @@ # Base pinned by digest so a rebuild of an old commit produces the same image. # Dependabot (docker ecosystem) proposes digest bumps; nothing floats silently. -FROM eclipse-temurin:21-jre-alpine@sha256:3f08b13888f595cc49edabea7250ba69499ba25602b267da591720769400e08c +FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0 # Runs as an unprivileged uid: the jar needs no write access outside /tmp. RUN addgroup -S finix && adduser -S -u 10001 -G finix finix diff --git a/services/vault-service/Dockerfile b/services/vault-service/Dockerfile index e0b3d55..a821d20 100644 --- a/services/vault-service/Dockerfile +++ b/services/vault-service/Dockerfile @@ -1,6 +1,6 @@ # Base pinned by digest so a rebuild of an old commit produces the same image. # Dependabot (docker ecosystem) proposes digest bumps; nothing floats silently. -FROM eclipse-temurin:21-jre-alpine@sha256:3f08b13888f595cc49edabea7250ba69499ba25602b267da591720769400e08c +FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0 # Runs as an unprivileged uid: the jar needs no write access outside /tmp. RUN addgroup -S finix && adduser -S -u 10001 -G finix finix