Pin Debian Docker image to bookworm for better hermeticity.

Prompted by #9 PiperOrigin-RevId: 582175219
google · Nov 14, 2023 · a952508 · a952508
1 parent faa604c
commit a952508
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/.kokoro/gcp_ubuntu/kokoro_build.sh b/.kokoro/gcp_ubuntu/kokoro_build.sh
@@ -22,7 +22,9 @@ set -eu
 # in the job configuration.
 cd "${KOKORO_ARTIFACTS_DIR}/github/silifuzz/.kokoro/gcp_ubuntu"
 
-DOCKER_IMAGE=debian
+# Pin Debian Docker image to bookworm for better hermeticity.
+# See https://github.com/google/silifuzz/issues/9.
+DOCKER_IMAGE=debian:bookworm
 
 docker run \
   --security-opt seccomp=unconfined \

diff --git a/README.md b/README.md
@@ -153,7 +153,7 @@ cd "${SILIFUZZ_BIN_DIR}"
 
 NOTE: You can use a Docker container to avoid polluting the host system: `docker
 run -it --tty --security-opt seccomp=unconfined --mount
-type=bind,source=${SILIFUZZ_SRC_DIR},target=/app debian /bin/bash -c "cd /app &&
+type=bind,source=${SILIFUZZ_SRC_DIR},target=/app debian:bookworm /bin/bash -c "cd /app &&
 ./install_build_dependencies.sh && bazel build ... && bazel test ..."`
 
 ### Prework (fuzzing Unicorn target)