[ABB65]

Release path: studio image and BuildKit from the ECR Public mirrors, pinned by digest

Why: Docker Hub's anonymous pull limit has been stopping builds (migrate staging web; this repo's postgres-lineage, fixed in #450). A tag release pulls from Docker Hub twice: the image's node:22-slim base, and BuildKit for docker/setup-buildx-action. #449 needs a tag release in the morning.

Change:

• Dockerfile: all three FROM node:22-slim (deps, build, runtime) → public.ecr.aws/docker/library/node:22-slim@sha256:c3de60bf2f9dd0ac6370e6117950ff62d6e339527e7472301c9c78a017978392, the same ref as migrate#734. A header comment records the reason, the date, both digests, and how to update.
• release.yml: docker/setup-buildx-action@v4 gets driver-opts: image=public.ecr.aws/vend/moby/buildkit:buildx-stable-1@sha256:cec9f139f45e93c5c69c60f8b07cfad9f43f4ef6b6a6cd917527fea5ff2e3dea (the action's default tag buildx-stable-1, now pinned), with the same kind of comment.

Digest check (2026-10-10, docker buildx imagetools inspect): both are an OCI image index (multi-arch), identical on both registries:

• docker.io/library/node:22-slim = public.ecr.aws/docker/library/node:22-slim = sha256:c3de60bf…978392
• docker.io/moby/buildkit:buildx-stable-1 = public.ecr.aws/vend/moby/buildkit:buildx-stable-1 = sha256:cec9f139…e3dea

On the BuildKit mirror: public.ecr.aws/docker/library carries only Docker Official Images, and BuildKit isn't one. public.ecr.aws/vend/moby/buildkit is the mirror that serves it. I pinned it by digest, and the digest is the one Docker Hub serves for moby/buildkit:buildx-stable-1. The pull is content-addressed, so the mirror can't serve anything other than those exact bytes, whoever runs it. ORK decides whether that's trustworthy enough. The fallback is to drop the driver-opts line (Docker Hub again).

Proof

• actionlint 1.7.7 on release.yml + ci.yml: one finding, SC2034 PATCH appears unused at release.yml:37. It's pre-existing: the same finding on main's release.yml, in a line this PR doesn't touch. The YAML parses, and the step carries the new driver-opts.
• BuildKit ref: docker buildx create --driver docker-container --driver-opt image=<the pinned ref> --bootstrap → Status running, BuildKit v0.33.1; then removed.
• Local docker build .: the base came from public.ecr.aws (load metadata for the pinned ref); deps 1–5 passed (corepack, pnpm install --frozen-lockfile); build reached pnpm build, which ran out of JS heap ("Reached heap limit", exit 134).
  • That's this machine's Docker VM (2 GB RAM). The FROM change doesn't touch the build's memory: same Node, same bytes as before. The release runner (ubuntu-latest, more memory than this VM) has built this same step on every release so far.
  • Not proven locally: the full image. release.yml runs only on a v* tag (no workflow_dispatch), so the first tag release is the end-to-end proof. If it fails at the pull, reverting this PR restores the Docker Hub refs.
• No other changes; ci.yml (ci: postgres service image from the ECR Public mirror, pinned by digest #450) is separate.

[ABB65]

ork2 review @a0336129: OK, with one disclosed gap.

• The Dockerfile's 3 FROM lines use the same node:22-slim index digest as migrate#734 (c3de60bf…).
• buildx driver-opts pulls buildkit from public.ecr.aws/vend/moby/buildkit, pinned to the digest docker.io serves (cec9f139…), so the mirror can't serve different bytes. Fallback: drop the line.
• Proof:
  • actionlint shows only the pre-existing SC2034;
  • a buildx builder bootstrapped with the pinned image (BuildKit v0.33.1);
  • the local image build pulled the base from ECR and passed deps.
• Gap: pnpm build hit an OOM in the local 2 GB Docker VM, so the full image isn't proven locally. release.yml runs only on v* tags, so the first tag release is the end-to-end proof, and a revert restores the old refs.

[ABB65]

ork2 OK @c7f4ce61 (main f269792 / #450 merged in with --no-commit + a hooked commit). It's 0 behind main, and the diff against main is still only Dockerfile + release.yml. ORK merges once ci + postgres-lineage are green on this head.