Use docker buildx 0.8.x --no-cache-filter to avoid using cached amazonlinux image #1221
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Is this a bug fix or adding new feature? /feature
What is this PR about? / Why do we need it?
When building image, always run
yum update -y
and avoid using whatever amazonlinux image/layer is in the cache because it might be outdated.--no-cache-filter requires buildx 0.8.x which just came out in March https://github.com/docker/buildx/releases/tag/v0.8.0
there is another flag --no-cache that is available in earlier versions but I DON'T want to use that because it means that the windows layers don't get cached and those take a LONG time to build.
We need to build new images frequently to keep up with CVEs in amazonlinux image. At least until we switch to a "minimal" image that has less surface area for CVEs.
What testing is done?
make image
works and yum update -y is always run, it's not cached.