From edfdda86aeb05dd487b8ca72b8a7f389de48e13f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa?=
<dani-garcia@users.noreply.github.com>
Date: Sun, 1 Mar 2020 02:38:26 +0100
Subject: [PATCH] Use web vault built by docker autobuild, using the hash to
reference the image for extra security
---
docker/Dockerfile.j2 | 50 +++++++++--------------
docker/aarch64/mysql/Dockerfile | 24 +++++------
docker/aarch64/sqlite/Dockerfile | 24 +++++------
docker/amd64/mysql/Dockerfile | 24 +++++------
docker/amd64/mysql/Dockerfile.alpine | 23 +++++------
docker/amd64/postgresql/Dockerfile | 24 +++++------
docker/amd64/postgresql/Dockerfile.alpine | 23 +++++------
docker/amd64/sqlite/Dockerfile | 24 +++++------
docker/amd64/sqlite/Dockerfile.alpine | 23 +++++------
docker/armv6/mysql/Dockerfile | 24 +++++------
docker/armv6/sqlite/Dockerfile | 24 +++++------
docker/armv7/mysql/Dockerfile | 24 +++++------
docker/armv7/sqlite/Dockerfile | 24 +++++------
13 files changed, 139 insertions(+), 196 deletions(-)
diff --git a/docker/Dockerfile.j2 b/docker/Dockerfile.j2
index cdf83eeb..ad1e4250 100644
--- a/docker/Dockerfile.j2
+++ b/docker/Dockerfile.j2
@@ -1,16 +1,10 @@
-{{ "# This file was generated using a Jinja2 template." }}
-{{ "# Please make your changes in `Dockerfile.j2` and then `make` the individual Dockerfile's." }}
+# This file was generated using a Jinja2 template.
+# Please make your changes in `Dockerfile.j2` and then `make` the individual Dockerfile's.
-# Using multistage build:
-# https://docs.docker.com/develop/develop-images/multistage-build/
-# https://whitfin.io/speeding-up-rust-docker-builds/
-####################### VAULT BUILD IMAGE #######################
{% set build_stage_base_image = "rust:1.40" %}
-{% set vault_stage_base_image = build_stage_base_image %}
{% if "alpine" in target_file %}
{% set build_stage_base_image = "clux/muslrust:nightly-2019-12-19" %}
{% set runtime_stage_base_image = "alpine:3.11" %}
-{% set vault_stage_base_image = runtime_stage_base_image %}
{% set package_arch_name = "" %}
{% elif "amd64" in target_file %}
{% set runtime_stage_base_image = "debian:buster-slim" %}
@@ -29,29 +23,23 @@
{% if package_arch_name == "" %}
{% set package_arch_prefix = "" %}
{% endif %}
-FROM {{ vault_stage_base_image }} as vault
-
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-{% if "alpine" in vault_stage_base_image %}
-RUN apk add --no-cache --upgrade curl tar
-{% else %}
-# Build time options to avoid dpkg warnings and help with reproducible builds.
-ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color
-{% endif %}
-
-WORKDIR /
-
-{% if "alpine" in vault_stage_base_image %}
-SHELL ["/bin/ash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-{% else %}
-SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-{% endif %}
-
-RUN curl -L $URL | tar xz
-RUN ls
+# Using multistage build:
+# https://docs.docker.com/develop/develop-images/multistage-build/
+# https://whitfin.io/speeding-up-rust-docker-builds/
+####################### VAULT BUILD IMAGE #######################
+{% set vault_image_hash = "sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c" %}
+{% raw %}
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+{% endraw %}
+FROM bitwardenrs/web-vault@{{ vault_image_hash }} as vault
########################## BUILD IMAGE ##########################
{% if "musl" in build_stage_base_image %}
diff --git a/docker/aarch64/mysql/Dockerfile b/docker/aarch64/mysql/Dockerfile
index 14a0cbff..9e2812e8 100644
--- a/docker/aarch64/mysql/Dockerfile
+++ b/docker/aarch64/mysql/Dockerfile
@@ -5,21 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM rust:1.40 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-# Build time options to avoid dpkg warnings and help with reproducible builds.
-ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color
-
-WORKDIR /
-
-SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# We need to use the Rust build image, because
diff --git a/docker/aarch64/sqlite/Dockerfile b/docker/aarch64/sqlite/Dockerfile
index 0c2e7dbf..f130faca 100644
--- a/docker/aarch64/sqlite/Dockerfile
+++ b/docker/aarch64/sqlite/Dockerfile
@@ -5,21 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM rust:1.40 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-# Build time options to avoid dpkg warnings and help with reproducible builds.
-ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color
-
-WORKDIR /
-
-SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# We need to use the Rust build image, because
diff --git a/docker/amd64/mysql/Dockerfile b/docker/amd64/mysql/Dockerfile
index 6e12db2b..7f47c475 100644
--- a/docker/amd64/mysql/Dockerfile
+++ b/docker/amd64/mysql/Dockerfile
@@ -5,21 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM rust:1.40 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-# Build time options to avoid dpkg warnings and help with reproducible builds.
-ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color
-
-WORKDIR /
-
-SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# We need to use the Rust build image, because
diff --git a/docker/amd64/mysql/Dockerfile.alpine b/docker/amd64/mysql/Dockerfile.alpine
index 9bc6a51e..c3fff716 100644
--- a/docker/amd64/mysql/Dockerfile.alpine
+++ b/docker/amd64/mysql/Dockerfile.alpine
@@ -5,20 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM alpine:3.11 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-RUN apk add --no-cache --upgrade curl tar
-
-WORKDIR /
-
-SHELL ["/bin/ash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# Musl build image for statically compiled binary
diff --git a/docker/amd64/postgresql/Dockerfile b/docker/amd64/postgresql/Dockerfile
index 8428de9e..8cfa3905 100644
--- a/docker/amd64/postgresql/Dockerfile
+++ b/docker/amd64/postgresql/Dockerfile
@@ -5,21 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM rust:1.40 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-# Build time options to avoid dpkg warnings and help with reproducible builds.
-ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color
-
-WORKDIR /
-
-SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# We need to use the Rust build image, because
diff --git a/docker/amd64/postgresql/Dockerfile.alpine b/docker/amd64/postgresql/Dockerfile.alpine
index 12f2e529..c9574c5e 100644
--- a/docker/amd64/postgresql/Dockerfile.alpine
+++ b/docker/amd64/postgresql/Dockerfile.alpine
@@ -5,20 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM alpine:3.11 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-RUN apk add --no-cache --upgrade curl tar
-
-WORKDIR /
-
-SHELL ["/bin/ash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# Musl build image for statically compiled binary
diff --git a/docker/amd64/sqlite/Dockerfile b/docker/amd64/sqlite/Dockerfile
index e120c18e..af2e792c 100644
--- a/docker/amd64/sqlite/Dockerfile
+++ b/docker/amd64/sqlite/Dockerfile
@@ -5,21 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM rust:1.40 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-# Build time options to avoid dpkg warnings and help with reproducible builds.
-ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color
-
-WORKDIR /
-
-SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# We need to use the Rust build image, because
diff --git a/docker/amd64/sqlite/Dockerfile.alpine b/docker/amd64/sqlite/Dockerfile.alpine
index 8cd9251e..881b2e58 100644
--- a/docker/amd64/sqlite/Dockerfile.alpine
+++ b/docker/amd64/sqlite/Dockerfile.alpine
@@ -5,20 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM alpine:3.11 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-RUN apk add --no-cache --upgrade curl tar
-
-WORKDIR /
-
-SHELL ["/bin/ash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# Musl build image for statically compiled binary
diff --git a/docker/armv6/mysql/Dockerfile b/docker/armv6/mysql/Dockerfile
index d55e12b9..5f815760 100644
--- a/docker/armv6/mysql/Dockerfile
+++ b/docker/armv6/mysql/Dockerfile
@@ -5,21 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM rust:1.40 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-# Build time options to avoid dpkg warnings and help with reproducible builds.
-ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color
-
-WORKDIR /
-
-SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# We need to use the Rust build image, because
diff --git a/docker/armv6/sqlite/Dockerfile b/docker/armv6/sqlite/Dockerfile
index ee6b5902..37560904 100644
--- a/docker/armv6/sqlite/Dockerfile
+++ b/docker/armv6/sqlite/Dockerfile
@@ -5,21 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM rust:1.40 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-# Build time options to avoid dpkg warnings and help with reproducible builds.
-ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color
-
-WORKDIR /
-
-SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# We need to use the Rust build image, because
diff --git a/docker/armv7/mysql/Dockerfile b/docker/armv7/mysql/Dockerfile
index c486595f..c1183cce 100644
--- a/docker/armv7/mysql/Dockerfile
+++ b/docker/armv7/mysql/Dockerfile
@@ -5,21 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM rust:1.40 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-# Build time options to avoid dpkg warnings and help with reproducible builds.
-ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color
-
-WORKDIR /
-
-SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# We need to use the Rust build image, because
diff --git a/docker/armv7/sqlite/Dockerfile b/docker/armv7/sqlite/Dockerfile
index 7cce852d..cfd1dc7d 100644
--- a/docker/armv7/sqlite/Dockerfile
+++ b/docker/armv7/sqlite/Dockerfile
@@ -5,21 +5,17 @@
# https://docs.docker.com/develop/develop-images/multistage-build/
# https://whitfin.io/speeding-up-rust-docker-builds/
####################### VAULT BUILD IMAGE #######################
-FROM rust:1.40 as vault
-ENV VAULT_VERSION "v2.12.0d"
-
-ENV URL "https://github.com/dani-garcia/bw_web_builds/releases/download/$VAULT_VERSION/bw_web_$VAULT_VERSION.tar.gz"
-
-# Build time options to avoid dpkg warnings and help with reproducible builds.
-ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8 TZ=UTC TERM=xterm-256color
-
-WORKDIR /
-
-SHELL ["/bin/bash", "-o", "nounset", "-o", "pipefail", "-o", "errexit", "-c"]
-
-RUN curl -L $URL | tar xz
-RUN ls
+# This hash is extracted from the docker web-vault builds and it's prefered over a simple tag because it's immutable.
+# It can be viewed in multiple ways:
+# - From the https://hub.docker.com/repository/docker/bitwardenrs/web-vault/tags page, click the tag name and the digest should be there.
+# - From the console, with the following commands:
+# docker pull bitwardenrs/web-vault:v2.12.0e
+# docker image inspect --format "{{.RepoDigests}}" bitwardenrs/web-vault:v2.12.0e
+#
+# - To do the opposite, and get the tag from the hash, you can do:
+# docker image inspect --format "{{.RepoTags}}" bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c
+FROM bitwardenrs/web-vault@sha256:ce56b3f5e538351411785ac45e9b4b913259c3508b1323d62e8fa0f30717dd1c as vault
########################## BUILD IMAGE ##########################
# We need to use the Rust build image, because