Pin base container image for runtime

[Aruku64-QPV]

I would like to make my builds strongly inmutable: can I somehow specify a digest for the image to use to create the containers?

[Willbin]

Hello @Aruku64-QPV,

Welcome to Google Cloud Community!

You can use container image digests to specify the exact version of an image to use. Image digests are unique identifiers for container images that are derived from the image content, making them immutable and ensuring that the same digest always points to the same image content. 

For best practices in operating containers, see this document.

[Aruku64-QPV]

Hi @Willbin.

Thank you for your answer, and I apologize for how long it took me to get back to this thread.

I'm realizing I didn't specify I meant whatever images Cloud Build uses to run the builds. I assume I can specify the digest of an specific cloud-builder to be used in the name field of each step in the yaml, but what about the orchestrator of those steps?