feat: add ubuntu version-specific image tags (#330)

Define UBUNTU_VERSION in scripts/images.sh as a single source of truth.
Dockerfiles consume it via a build arg, and the push script reads the
same variable to generate version-specific tags. No runtime detection
or sidecar files needed.

Updated Dockerfiles to use ARG UBUNTU_VERSION:
- base, minimal: FROM ubuntu:${UBUNTU_VERSION}
- universal: FROM mcr.microsoft.com/devcontainers/universal:${UBUNTU_VERSION}
- Derivative images (golang, java, node, desktop) are unchanged since
  they inherit from locally-built base/minimal images.

New tags pushed per image:
- ubuntu-{version} (e.g., ubuntu-noble)
- ubuntu-{version}-{date} (e.g., ubuntu-noble-20250101)

Existing tags (ubuntu, ubuntu-{date}, latest) are unchanged.

Closes #282

Author: matifali

.gitignore

@@ -1,3 +1,4 @@
 node_modules
 *.sarif
 tmp.*
+build_*.json

README.md

@@ -19,6 +19,18 @@ https://hub.docker.com/r/codercom/example-base. The tag is taken from the
 filename of the Dockerfile. For example, `base/ubuntu.Dockerfile` is
 under the `ubuntu` tag.
 
+### Available Tags
+
+Each image is published with the following tag variants:
+
+| Tag                       | Example                                       | Description                                        |
+| ------------------------- | --------------------------------------------- | -------------------------------------------------- |
+| `ubuntu`                  | `codercom/example-base:ubuntu`                | Latest Ubuntu version (rolling)                    |
+| `ubuntu-{version}`        | `codercom/example-base:ubuntu-noble`          | Pinned to a specific Ubuntu release                |
+| `ubuntu-{date}`           | `codercom/example-base:ubuntu-20250101`       | Snapshot from a specific build date                |
+| `ubuntu-{version}-{date}` | `codercom/example-base:ubuntu-noble-20250101` | Version-pinned snapshot from a specific build date |
+| `latest`                  | `codercom/example-base:latest`                | Alias for the latest build                         |
+
 > For backward compatibility, these images are also available with the `enterprise-` prefix
 > (e.g., `codercom/enterprise-base`), but the `example-` prefix is recommended for new deployments.
 

images/base/ubuntu.Dockerfile

@@ -1,4 +1,5 @@
-FROM ubuntu:noble
+ARG UBUNTU_VERSION=noble
+FROM ubuntu:${UBUNTU_VERSION}
 
 SHELL ["/bin/bash", "-c"]
 ENV DEBIAN_FRONTEND=noninteractive

images/minimal/ubuntu.Dockerfile

@@ -1,4 +1,5 @@
-FROM ubuntu:noble
+ARG UBUNTU_VERSION=noble
+FROM ubuntu:${UBUNTU_VERSION}
 
 USER root
 ENV DEBIAN_FRONTEND=noninteractive

images/universal/ubuntu.Dockerfile

@@ -1,4 +1,5 @@
-FROM mcr.microsoft.com/devcontainers/universal:linux
+ARG UBUNTU_VERSION=noble
+FROM mcr.microsoft.com/devcontainers/universal:${UBUNTU_VERSION}
 
 USER root
 

scripts/build_images.sh

@@ -111,6 +111,7 @@ for image in "${IMAGES[@]}"; do
   fi
 
   run_trace $DRY_RUN depot build --project "gb3p8xrshk" --load --platform "$platform" --save --metadata-file="build_${image}.json" \
+    --build-arg "UBUNTU_VERSION=$UBUNTU_VERSION" \
     "${docker_flags[@]}" \
     "$image_dir" \
     --file="$image_path" \

scripts/images.sh

@@ -2,6 +2,12 @@
 
 set -euo pipefail
 
+# UBUNTU_VERSION defines the Ubuntu release used as the base for all
+# images. Changing this value and rebuilding will produce images on
+# a different Ubuntu release. All Dockerfiles and the push script
+# read this variable so it acts as a single source of truth.
+UBUNTU_VERSION="noble"
+
 # IMAGES defines the list of images to build/push IN ORDER.
 IMAGES=(
   "base"

scripts/push_images.sh

@@ -106,14 +106,22 @@ for image in "${IMAGES[@]}"; do
   fi
 
   build_id=$(cat "build_${image}.json" | jq -r .\[\"depot.build\"\].buildID)
-  
+
   # Push example images (primary)
   run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "$example_image_ref" "$build_id"
   run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "$example_image_ref_date" "$build_id"
   run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "codercom/example-${image}:latest" "$build_id"
-  
+
   # Push enterprise images (alias)
   run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "$enterprise_image_ref" "$build_id"
   run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "$enterprise_image_ref_date" "$build_id"
   run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "codercom/enterprise-${image}:latest" "$build_id"
+
+  # Push version-specific tags so users can pin to a specific Ubuntu
+  # release. UBUNTU_VERSION is defined in images.sh and is the single
+  # source of truth used by both the Dockerfiles and this script.
+  for prefix in "example" "enterprise"; do
+    run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "codercom/${prefix}-${image}:${TAG}-${UBUNTU_VERSION}" "$build_id"
+    run_trace $DRY_RUN depot push --project "gb3p8xrshk" --tag "codercom/${prefix}-${image}:${TAG}-${UBUNTU_VERSION}-${date_str}" "$build_id"
+  done
 done