chore(build): move the UI image's nginx to 1.31.3 and pin it by digest

The runtime stage tracked nginx 1.27, a mainline line that upstream stopped
maintaining once 1.29 landed, so it no longer picks up any upstream fixes.
Move to 1.31.3-alpine3.24, which keeps the image on the mainline line it
already followed and brings the Alpine base in line with the Node 24
builder stage above it.

Pin the ref by digest and fold it into a UI_RUNTIME_IMAGE arg, matching how
UI_BUILD_IMAGE already carries a full digest-pinned ref. A floating
1.31-alpine tag would have resolved to 1.31.4, published earlier today, and
the digest pin keeps the image reproducible instead of drifting whenever
upstream rebuilds the tag.

Verified by building the runtime stage against both the old and new bases
from a byte-identical static export: the config parses on both and all 17
probed routes match on status, content type, cache headers, gzip
negotiation, and body hash. The only response delta is the nginx version
string in the Server header and the built-in 404 page.
This commit is contained in:
Yuneng Jiang 2026-08-19 13:29:19 -07:00
parent 4bb3152cc5
commit dd8605cff0
No known key found for this signature in database

View file

@ -3,7 +3,7 @@
# UI container — Next.js static export served by nginx.
ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43
ARG NGINX_VERSION=1.27-alpine
ARG UI_RUNTIME_IMAGE=nginx:1.31.3-alpine3.24@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752
# ---------- builder ----------
FROM ${UI_BUILD_IMAGE} AS builder
@ -24,7 +24,7 @@ COPY ui/litellm-dashboard/ ./
RUN npm run build
# ---------- runtime ----------
FROM nginx:${NGINX_VERSION} AS runtime
FROM ${UI_RUNTIME_IMAGE} AS runtime
# Drop the upstream default :80 server; we own the config.
RUN rm -f /etc/nginx/conf.d/default.conf