golden-images.yaml

# =============================================================================
# Golden Images Standard
# =============================================================================
# Managed by:    Infrastructure / DevOps Team
# Source:        https://github.com/tinyfish-io/github-control
# Linear ticket: https://linear.app/tinyfish/issue/INF-1097
#
# This file is automatically replicated to ALL active repositories.
# DO NOT edit this file locally — changes will be overwritten on next
# Terraform apply. To propose updates, open a PR in github-control.
#
# -----------------------------------------------------------------------------
# TIER DEFINITIONS
# -----------------------------------------------------------------------------
#   recommended:
#     DevOps-owned. The Infrastructure team handles OS-level CVE monitoring,
#     Vanta ticket triage, quarterly SHA digest updates, and patch coordination.
#
#   acceptable:
#     Developer-owned. Teams using this image are fully responsible for:
#       - Monitoring OS-level CVEs flagged by AWS Inspector / Vanta
#       - Filing and remediating their own security tickets
#       - Upgrading to the recommended tier before the image's EOL date
#     Using an acceptable-tier image does NOT exempt a team from Vanta SLAs.
#
# -----------------------------------------------------------------------------
# USAGE (Dockerfile)
# -----------------------------------------------------------------------------
#   Always reference the full URI with the SHA256 digest for build immutability.
#   Floating tags (:latest, :22, :3.12) are PROHIBITED in production Dockerfiles.
#
#   CORRECT:
#     FROM node:24-bookworm-slim@sha256:3638d9a6fe4030bd716be989438248074489337ba3275657f93595428be4fc03
#
#   WRONG:
#     FROM node:24-bookworm-slim
#     FROM node:latest
#     FROM node:22
#
# =============================================================================

golden_images:
  # ---------------------------------------------------------------------------
  # Node.js
  # ---------------------------------------------------------------------------
  nodejs:
    - tier: recommended
      alias: node-24-lts
      image: node:24-bookworm-slim
      uri: node:24-bookworm-slim@sha256:3638d9a6fe4030bd716be989438248074489337ba3275657f93595428be4fc03
      runtime_version: "24.19.0"
      base_os: Debian 12 (Bookworm) slim
      digest_updated: "2026-08-08"
      eol: "2028-04-30"
      description: >
        Node.js 24 LTS on Debian 12 Bookworm slim. DevOps-managed. Slim variant reduces attack surface vs the full image
        while retaining native-module compatibility (unlike Alpine/musl). Receives timely Debian security patches for
        OS-level packages.
      use_case: "All Node.js services, CI builds, tooling containers."

    - tier: acceptable
      alias: node-22-lts
      image: node:22-bookworm-slim
      uri: node:22-bookworm-slim@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
      runtime_version: "22.23.2"
      base_os: Debian 12 (Bookworm) slim
      digest_updated: "2026-08-08"
      eol: "2027-04-30"
      description: >
        Node.js 22 LTS on Debian 12 Bookworm slim. DEVELOPER-managed. Teams using this image are responsible for
        OS-level CVE monitoring, patching, and Vanta ticket remediation independently.
      use_case: "Teams not yet migrated to Node 24 LTS."
      caveats:
        - "Migrate to node-24-lts (recommended) before April 2027 EOL."
        - "Developer team owns OS-level CVE patching and all Vanta SLA obligations."

    - tier: recommended
      alias: node-24-distroless
      image: gcr.io/distroless/nodejs24-debian13:nonroot
      uri: gcr.io/distroless/nodejs24-debian13:nonroot@sha256:fbbdda866ea71aef98c4abece17e3d61fbf820cc2ef3961522caa2478716171a
      runtime_version: "24.18.0"
      base_os: Debian 13 (Trixie), distroless — no package manager
      digest_updated: "2026-08-08"
      eol: "2028-04-30"
      description: >
        Node.js 24 LTS on Google's distroless Debian 13 base. DevOps-managed. Ships the Node runtime plus glibc,
        libstdc++, OpenSSL 3, libgomp, zlib and zstd — 13 OS packages, 31 shared library files — and nothing
        else: no shell, no package manager, no npm, no coreutils. Runs as UID 65532 (nonroot) enforced in the
        image config, so a container cannot accidentally run as root. This is a RUNTIME image; it cannot build.
      selection_rationale: >
        Shrinks the base-image CVE surface instead of patching it. node:24-bookworm-slim carries 88 Debian
        packages (measured 2026-07-26); this image carries 13 — an 85% reduction. It also ships no bundled
        global npm, which removes a second recurring finding source: the internal-tools frontend had to
        apt-upgrade openssl and then delete /usr/local/lib/node_modules/npm outright to clear CVEs vendored
        inside npm's own dependency tree (picomatch, and previously minimatch and tar), none of which the
        application ever executed. Both of those hand-patches become unnecessary here, and base-image
        remediation collapses to one quarterly digest rotation. Scope note: this covers the base image only.
        Application dependencies are copied into the final image unchanged, so their CVEs are unaffected and
        remain the job of Dependabot/OSV-Scanner and the owning team. Distroless also cuts post-exploitation
        blast radius — with no /bin/sh, no curl and no package manager, an attacker holding code execution has
        no tooling to pivot. Debian 13 is specified rather than the debian12 variant because debian12 ships
        Node 24.14.0 while the services migrating to this image already run 24.18.0; pinning debian12 would
        silently downgrade the runtime by four minor releases. As of the 2026-08-08 refresh, node-24-lts is
        at 24.19.0 and this runtime at 24.18.0, so the builder is one minor ahead of the runtime rather than
        the two patch levels behind it that the overdue digest review had produced.
      use_case: "Final runtime stage of a multi-stage Node build. Pair with node-24-lts as the builder stage."
      caveats:
        - "Runtime only — has no npm and no shell, so it cannot be used as a builder stage."
        - >-
          No shell means no interactive debugging: `docker exec` and `aws ecs execute-command` give you
          nothing. Use the matching :debug-nonroot variant (busybox included) for troubleshooting, never in
          production. Note :debug is the root-running variant — prefer :debug-nonroot to keep the same UID.
        - >-
          Prebuilt native addons may need a system library staged in from the builder. Verified case:
          node-canvas needs libuuid.so.1, which this image omits — copy it by library NAME, never by a
          hardcoded multiarch path, and set LD_LIBRARY_PATH so it resolves on both amd64 and arm64.
        - >-
          No apt, so OS CVEs cannot be patched in-image. Remediation is a digest rotation through this
          file — which is why this entry is recommended-tier and DevOps-owned.
        - >-
          The image ENTRYPOINT is already /nodejs/bin/node, so CMD takes the script path alone:
          CMD ["server.js"].
        - >-
          fontconfig has no default config file. If the service renders text via node-canvas, ship a
          minimal fonts.conf and set FONTCONFIG_FILE, otherwise every render logs a benign
          "Cannot load default config file" error.

  # ---------------------------------------------------------------------------
  # Python
  # ---------------------------------------------------------------------------
  python:
    - tier: recommended
      alias: python-313
      image: python:3.13-slim-bookworm
      uri: python:3.13-slim-bookworm@sha256:67a1e1f215ccda113cfc024e8639049257e88f273898f595b61476d128d387e8
      runtime_version: "3.13.14"
      base_os: Debian 12 (Bookworm) slim
      digest_updated: "2026-08-08"
      eol: "2029-10-31"
      description: >
        Python 3.13 on Debian 12 Bookworm slim. DevOps-managed. Slim variant minimizes pre-installed packages, reducing
        the OS-level attack surface while remaining fully pip-compatible.
      use_case: "All Python services, ML workloads, data pipelines, Lambda containers."

    - tier: acceptable
      alias: python-312
      image: python:3.12-slim-bookworm
      uri: python:3.12-slim-bookworm@sha256:4766d8b510c428e595d74b9cc5bbb2fae8e26316fffb4adc89908d79aacd58a2
      runtime_version: "3.12.13"
      base_os: Debian 12 (Bookworm) slim
      digest_updated: "2026-08-08"
      eol: "2028-10-31"
      description: >
        Python 3.12 on Debian 12 Bookworm slim. DEVELOPER-managed. Teams using this image are responsible for OS-level
        CVE monitoring, patching, and Vanta ticket remediation independently.
      use_case: "Teams not yet migrated to Python 3.13."
      caveats:
        - "Plan migration to python-313 (recommended) before October 2028 EOL."
        - "Developer team owns OS-level CVE patching and all Vanta SLA obligations."

  # ---------------------------------------------------------------------------
  # Microsoft Playwright (AI web automation)
  # ---------------------------------------------------------------------------
  playwright:
    - tier: recommended
      alias: playwright-latest
      image: mcr.microsoft.com/playwright:v1.58.2-noble
      uri: mcr.microsoft.com/playwright:v1.58.2-noble@sha256:6446946a1d9fd62d9ae501312a2d76a43ee688542b21622056a372959b65d63d
      runtime_version: "1.58.2"
      base_os: Ubuntu 24.04 LTS (Noble Numbat)
      digest_updated: "2026-08-08"
      description: >
        Microsoft Playwright v1.58.2 on Ubuntu 24.04 LTS (Noble). DevOps-managed. Pre-baked with all browser binaries
        (Chromium, Firefox, WebKit) and their system-level dependencies. Playwright is the backbone of our AI web
        automation workflows, enabling agents to interact with the web at scale.
      use_case: "AI web automation workflows, browser-based AI agents."

    - tier: acceptable
      alias: playwright-v154
      image: mcr.microsoft.com/playwright:v1.54.0-noble
      uri: mcr.microsoft.com/playwright:v1.54.0-noble@sha256:18d6adb6aaccf1b0f30eba890069972e089138e4a59ddb5303d7e7290e4e38b6
      runtime_version: "1.54.0"
      base_os: Ubuntu 24.04 LTS (Noble Numbat)
      digest_updated: "2026-08-08"
      description: >
        Microsoft Playwright v1.54.0 on Ubuntu 24.04 LTS (Noble). DEVELOPER-managed. Teams using this version are
        responsible for monitoring CVEs and upgrading to the recommended tier.
      use_case: "AI web automation workflows pinned to Playwright 1.54 pending migration."
      caveats:
        - "Upgrade to playwright-latest (recommended) once workflow compatibility with v1.58 is confirmed."
        - "Developer team owns OS-level CVE patching and all Vanta SLA obligations."
        - "4 minor versions behind recommended; bundled browser binaries may carry known CVEs."

# =============================================================================
# Metadata
# =============================================================================
metadata:
  last_reviewed: "2026-08-08"
  next_review_due: "2026-11-08"
  review_cadence: quarterly
  maintained_by: "Infrastructure / DevOps Team"
  linear_ticket: https://linear.app/tinyfish/issue/INF-1097
  policy: >
    All Dockerfiles MUST reference images from this file using the full URI with SHA256 digest (@sha256:...) for build
    immutability. Floating tags (e.g. :latest, :22, :3.12) are PROHIBITED in production Dockerfiles. This file is
    updated quarterly or upon critical CVE disclosure. To propose changes, open a PR in github-control referencing
    INF-1097.