Hacker News Reader

I do this occasionally. But it's because my company's security org has a ridiculous policy enforcing 0 CVE images for anything running on our infra (including internal CI images).

In some cases baking a dependency into an image is signing myself up for perpetual toil to keep the image CVE free.

Sure. Although you can expect build/test time to take a while on bigger projects, so I think it washes out a lot of the time.

Yeah, that drives me bonkers. Just set up a separate CI/CD for the images themselves that update daily as needed.

We set up a cache that detects when the project Dockerfiles or lockfiles change. If dependencies haven't changed, we check cache first, otherwise the image rebuilds as the first step of that pipeline and following pipeline steps use it. Best of both worlds.