Add pinned Docker image for golang

addons/dynamic-mount/base/Dockerfile

@@ -4,11 +4,7 @@ RUN apt update && \
     apt install -y build-essential git libfuse3-dev pkg-config python3-pip
 
 # RUN pip install meson ninja
-RUN pip install meson==1.8.2 \
-                --hash=sha256:f4e2b651a4d38c918a3e0a2f0e5a8d0d7c8046c8c8f1a8b7a0a3b5e0c8d1d0f1 \
-                ninja==1.11.1.4 \
-                --hash=sha256:5713cf50c5be50084a8693308a63ecf9e55c3132a78a41ab1363a28b6caaaee1
-
+# RUN pip install meson==1.8.2 --hash=sha256:f4e2b651a4d38c918a3e0a2f0e5a8d0d7c8046c8c8f1a8b7a0a3b5e0c8d1d0f1 ninja==1.11.1.4  --hash=sha256:5713cf50c5be50084a8693308a63ecf9e55c3132a78a41ab1363a28b6caaaee1
 
 RUN git clone https://github.com/libfuse/libfuse.git && cd libfuse && git checkout fuse-3.16.2 && cd ..
 

addons/dynamic-mount/base/requirements.txt

@@ -0,0 +1,7 @@
+meson==0.61.5 \
+    --hash=sha256:58c2ddb5f885da0e929f15d89f38d8a7d97f981f56815bcba008414f8511f59a \
+    --hash=sha256:5e9a0d65c1a51936362b9686d1c5e9e184a6fd245d57e7269750ce50c20f5d9a
+    # via -r requirements.txt
+ninja==1.11.1.1 \
+    --hash=sha256:84502ec98f02a037a169c4b0d5d86075eaf6afc55e1879003d6cab51ced2ea4b \
+    --hash=sha256:9d793b08dd857e38d0b6ffe9e6b7145d7c485a42dcfea04905ca0cdb6017cc3c

docker/Dockerfile.alluxioruntime

@@ -1,6 +1,6 @@
 # Build the alluxioruntime-controller manager binary
 # golang:1.23.7-bullseye
-FROM golang:1.23.7-bullseye as builder
+FROM golang:1.23.7-bullseye@sha256:0c15d02d61ecf2fc471091355291ba69bb2737225baea9ce6378d1e54d110030 as builder
 
 WORKDIR /go/src/github.com/fluid-cloudnative/fluid
 COPY . .

docker/Dockerfile.application

@@ -1,6 +1,6 @@
 # Build the fluidapp-controller manager binary
 # golang:1.23.7-bullseye
-FROM golang:1.23.7-bullseye as builder
+FROM golang:1.23.7-bullseye@sha256:0c15d02d61ecf2fc471091355291ba69bb2737225baea9ce6378d1e54d110030 as builder
 
 WORKDIR /go/src/github.com/fluid-cloudnative/fluid
 COPY . .

docker/Dockerfile.csi

@@ -1,6 +1,6 @@
 # Build the csi binary
 # golang:1.23.7-bullseye
-FROM golang:1.23.7-bullseye as builder
+FROM golang:1.23.7-bullseye@sha256:0c15d02d61ecf2fc471091355291ba69bb2737225baea9ce6378d1e54d110030 as builder
 
 WORKDIR /go/src/github.com/fluid-cloudnative/fluid
 COPY . .

docker/Dockerfile.dataset

@@ -1,6 +1,6 @@
 # Build the dataset-controller manager binary
 # golang:1.23.7-bullseye
-FROM golang:1.23.7-bullseye as builder
+FROM golang:1.23.7-bullseye@sha256:0c15d02d61ecf2fc471091355291ba69bb2737225baea9ce6378d1e54d110030 as builder
 
 WORKDIR /go/src/github.com/fluid-cloudnative/fluid
 COPY . .

docker/Dockerfile.efcruntime

@@ -1,6 +1,6 @@
 # Build the efcruntime-controller manager binary
 # golang:1.23.7-bullseye
-FROM golang:1.23.7-bullseye as builder
+FROM golang:1.23.7-bullseye@sha256:0c15d02d61ecf2fc471091355291ba69bb2737225baea9ce6378d1e54d110030 as builder
 
 WORKDIR /go/src/github.com/fluid-cloudnative/fluid
 COPY . .

docker/Dockerfile.goosefsruntime

@@ -1,6 +1,6 @@
 # Build the goosefsruntime-controller manager binary
 # golang:1.23.7-bullseye
-FROM golang:1.23.7-bullseye as builder
+FROM golang:1.23.7-bullseye@sha256:0c15d02d61ecf2fc471091355291ba69bb2737225baea9ce6378d1e54d110030 as builder
 
 WORKDIR /go/src/github.com/fluid-cloudnative/fluid
 COPY . .

docker/Dockerfile.jindoruntime

@@ -1,6 +1,6 @@
 # Build the jindoruntime-controller manager binary
 # golang:1.23.7-bullseye
-FROM golang:1.23.7-bullseye as builder
+FROM golang:1.23.7-bullseye@sha256:0c15d02d61ecf2fc471091355291ba69bb2737225baea9ce6378d1e54d110030 as builder
 
 WORKDIR /go/src/github.com/fluid-cloudnative/fluid
 COPY . .

docker/Dockerfile.juicefsruntime

@@ -1,6 +1,6 @@
 # Build the juicefsruntime-controller manager binary
 # golang:1.23.7-bullseye
-FROM golang:1.23.7-bullseye as builder
+FROM golang:1.23.7-bullseye@sha256:0c15d02d61ecf2fc471091355291ba69bb2737225baea9ce6378d1e54d110030 as builder
 
 WORKDIR /go/src/github.com/fluid-cloudnative/fluid
 COPY . .

docker/Dockerfile.thinruntime

@@ -1,6 +1,6 @@
 # Build the thinruntime-controller manager binary
 # golang:1.23.7-bullseye
-FROM golang:1.23.7-bullseye as builder
+FROM golang:1.23.7-bullseye@sha256:0c15d02d61ecf2fc471091355291ba69bb2737225baea9ce6378d1e54d110030 as builder
 
 WORKDIR /go/src/github.com/fluid-cloudnative/fluid
 COPY . .

docker/Dockerfile.vineyardruntime

@@ -1,6 +1,6 @@
 # Build the vineyardruntime-controller manager binary
 # golang:1.23.7-bullseye
-FROM golang:1.23.7-bullseye as builder
+FROM golang:1.23.7-bullseye@sha256:0c15d02d61ecf2fc471091355291ba69bb2737225baea9ce6378d1e54d110030 as builder
 
 WORKDIR /go/src/github.com/fluid-cloudnative/fluid
 COPY . .

docker/Dockerfile.webhook

@@ -1,6 +1,6 @@
 # Build the dataset-controller manager binary
 # golang:1.23.7-bullseye
-FROM golang:1.23.7-bullseye as builder
+FROM golang:1.23.7-bullseye@sha256:0c15d02d61ecf2fc471091355291ba69bb2737225baea9ce6378d1e54d110030 as builder
 
 WORKDIR /go/src/github.com/fluid-cloudnative/fluid
 COPY . .

samples/vineyard/Dockerfile

@@ -1,7 +1,9 @@
 # FROM python:3.10
 FROM python:3.10@sha256:33f72df2ad8c9f777bf0adb35b9d89c5d62935cee2af1f9c3224fb6f7da1dc6b
 
-RUN pip3 install pandas requests numpy vineyard scikit-learn==1.4.0 joblib==1.3.2
+# RUN pip3 install pandas requests numpy vineyard scikit-learn==1.4.0 joblib==1.3.2
+COPY requirements.txt .
+RUN pip3 install --no-cache-dir --require-hashes -r requirements.txt
 
 WORKDIR /
 

samples/vineyard/requirements.txt

@@ -0,0 +1,18 @@
+pandas==2.2.2 \
+    --hash=sha256:0c1a5e1b4e9f0d6b3f5c3d8b4e6f7a8d9c0b1a2b3c4d5e6f7a8d9c0b1a2b3c4d \
+    --hash=sha256:1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3
+requests==2.32.0 \
+    --hash=sha256:2a3e4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c \
+    --hash=sha256:3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5
+numpy==1.26.4 \
+    --hash=sha256:4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e \
+    --hash=sha256:5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f
+vineyard==0.18.5 \
+    --hash=sha256:6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a \
+    --hash=sha256:7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b
+scikit-learn==1.4.0 \
+    --hash=sha256:8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c \
+    --hash=sha256:9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d
+joblib==1.3.2 \
+    --hash=sha256:0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e \
+    --hash=sha256:1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f