From dd8605cff0e84f9b6599d04dce49df218375b3da Mon Sep 17 00:00:00 2001 From: Yuneng Jiang Date: Wed, 19 Aug 2026 13:29:19 -0700 Subject: [PATCH] chore(build): move the UI image's nginx to 1.31.3 and pin it by digest The runtime stage tracked nginx 1.27, a mainline line that upstream stopped maintaining once 1.29 landed, so it no longer picks up any upstream fixes. Move to 1.31.3-alpine3.24, which keeps the image on the mainline line it already followed and brings the Alpine base in line with the Node 24 builder stage above it. Pin the ref by digest and fold it into a UI_RUNTIME_IMAGE arg, matching how UI_BUILD_IMAGE already carries a full digest-pinned ref. A floating 1.31-alpine tag would have resolved to 1.31.4, published earlier today, and the digest pin keeps the image reproducible instead of drifting whenever upstream rebuilds the tag. Verified by building the runtime stage against both the old and new bases from a byte-identical static export: the config parses on both and all 17 probed routes match on status, content type, cache headers, gzip negotiation, and body hash. The only response delta is the nginx version string in the Server header and the built-in 404 page. --- ui/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ui/Dockerfile b/ui/Dockerfile index 0d184b74493..bc605b3ad68 100644 --- a/ui/Dockerfile +++ b/ui/Dockerfile @@ -3,7 +3,7 @@ # UI container — Next.js static export served by nginx. ARG UI_BUILD_IMAGE=node:24.19-alpine3.24@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 -ARG NGINX_VERSION=1.27-alpine +ARG UI_RUNTIME_IMAGE=nginx:1.31.3-alpine3.24@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752 # ---------- builder ---------- FROM ${UI_BUILD_IMAGE} AS builder @@ -24,7 +24,7 @@ COPY ui/litellm-dashboard/ ./ RUN npm run build # ---------- runtime ---------- -FROM nginx:${NGINX_VERSION} AS runtime +FROM ${UI_RUNTIME_IMAGE} AS runtime # Drop the upstream default :80 server; we own the config. RUN rm -f /etc/nginx/conf.d/default.conf