Keycloak images are not immutable #38687

crtvmn · 2025-04-04T13:57:57Z

crtvmn
Apr 4, 2025

Hello,

I pulled the docker.io/keycloak/keycloak:26.0.8 image 3 months ago:

[
    {
        "Id": "sha256:c429531e4abe156b517026b029b144052da68268db8ff517104f4361007f770b",
        "RepoTags": [],
        "RepoDigests": [
            "keycloak/keycloak@sha256:0deab65b47ab31d3b24a294e4ab237ba3c07059b98215657feaa45d776ff2315"
        ],
        "Parent": "",
        "Comment": "buildkit.dockerfile.v0",
        "Created": "2025-01-13T16:09:00.906972892Z",
        "DockerVersion": "",
        "Author": "",
        "Config": {
            "Hostname": "",
            "Domainname": "",
            "User": "1000",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "8080/tcp": {},
                "8443/tcp": {},
                "9000/tcp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "LANG=en_US.UTF-8",
                "KC_RUN_IN_CONTAINER=true"
            ],
            "Cmd": null,
            "Image": "",
            "Volumes": null,
            "WorkingDir": "/",
            "Entrypoint": [
                "/opt/keycloak/bin/kc.sh"
            ],
            "OnBuild": null,
            "Labels": {
                "architecture": "x86_64",
                "build-date": "2025-01-09T12:46:01Z",
                "com.redhat.build-host": "",
                "com.redhat.component": "",
                "com.redhat.license_terms": "",
                "description": "Keycloak Server Image",
                "distribution-scope": "public",
                "io.buildah.version": "1.38.0-dev",
                "io.k8s.description": "Keycloak Server Image",
                "io.k8s.display-name": "Keycloak Server",
                "io.openshift.expose-services": "",
                "io.openshift.tags": "keycloak security identity",
                "maintainer": "https://www.keycloak.org/",
                "name": "keycloak",
                "org.opencontainers.image.created": "2025-01-13T16:08:19.293Z",
                "org.opencontainers.image.description": "",
                "org.opencontainers.image.documentation": "https://www.keycloak.org/documentation",
                "org.opencontainers.image.licenses": "Apache-2.0",
                "org.opencontainers.image.revision": "9dc36e6787c902eff4e74369e6a5fd3cd3798e1d",
                "org.opencontainers.image.source": "https://github.com/keycloak-rel/keycloak-rel",
                "org.opencontainers.image.title": "keycloak-rel",
                "org.opencontainers.image.url": "https://github.com/keycloak-rel/keycloak-rel",
                "org.opencontainers.image.version": "26.0.8",
                "release": "",
                "summary": "Keycloak Server Image",
                "url": "https://www.keycloak.org/",
                "vcs-ref": "",
                "vcs-type": "git",
                "vendor": "https://www.keycloak.org/",
                "version": "26.0.8"
            }
        },
        "Architecture": "amd64",
        "Os": "linux",
        "Size": 431876229,
        "GraphDriver": {
            "Data": {
                "LowerDir": "/var/lib/docker/overlay2/ba1df06c1ae0fead11f77b7f1a8636d1aa87e43ac32e90998106d8165abb419b/diff:/var/lib/docker/overlay2/dae8eea1e52b6b25635f9fd89c1b94500ae7dae1d903d514d4ef15d25ed3cb41/diff:/var/lib/docker/overlay2/831b3787403244956258939a72227fb023a1807ad058f71a880e706b9d8db1f9/diff:/var/lib/docker/overlay2/0b3ac34b66047d396d55040b44e30ce9650508bd6281907c90efd9dd3e1fef9f/diff",
                "MergedDir": "/var/lib/docker/overlay2/3e78d1bfb6c4cc26b7cbdda6ac65356ca026e34d767ca0f8c759a2dc5d8ce574/merged",
                "UpperDir": "/var/lib/docker/overlay2/3e78d1bfb6c4cc26b7cbdda6ac65356ca026e34d767ca0f8c759a2dc5d8ce574/diff",
                "WorkDir": "/var/lib/docker/overlay2/3e78d1bfb6c4cc26b7cbdda6ac65356ca026e34d767ca0f8c759a2dc5d8ce574/work"
            },
            "Name": "overlay2"
        },
        "RootFS": {
            "Type": "layers",
            "Layers": [
                "sha256:fed2e412bf40f1189ffcc8493138f6d8335273c3c1b8a49bb2b45d7421e99aed",
                "sha256:c954dbde53bd15be61172d8f5eaf6aeadf9d35fcdf37b4921b664751cfd1fd0e",
                "sha256:0bffab6eb4077b196d06c3349f844b97ff8169acfedfab3a30b7dea4026eb48a",
                "sha256:afcd68fa50c777d3849310a27cb9044ef24c3e1c758dea407299555020a001f4",
                "sha256:013c41959baece3773be9c439a7c8b9d9e91b26d33949afbfefbd3e9708a81e6"
            ]
        },
        "Metadata": {
            "LastTagTime": "0001-01-01T00:00:00Z"
        }
    }
]

I pulled again the docker.io/keycloak/keycloak:26.0.8 image today and I get a different image. The sha256, the io.buildah.version and the build-date labels have changed where has the version label is the same (26.0.8):

[
    {
        "Id": "sha256:e447933b6a5015646c24a1b927a40202ce07adbadac839e7a1f99c463d68a224",
        "RepoTags": [
            "keycloak/keycloak:26.0.8"
        ],
        "RepoDigests": [
            "keycloak/keycloak@sha256:09a381c715ab0b111835b70f2905955274843a219c6f27efb348e4d9f4086858"
        ],
        "Parent": "",
        "Comment": "buildkit.dockerfile.v0",
        "Created": "2025-02-20T14:47:15.267919298Z",
        "DockerVersion": "",
        "Author": "",
        "Config": {
            "Hostname": "",
            "Domainname": "",
            "User": "1000",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "ExposedPorts": {
                "8080/tcp": {},
                "8443/tcp": {},
                "9000/tcp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "LANG=en_US.UTF-8",
                "KC_RUN_IN_CONTAINER=true"
            ],
            "Cmd": null,
            "Image": "",
            "Volumes": null,
            "WorkingDir": "/",
            "Entrypoint": [
                "/opt/keycloak/bin/kc.sh"
            ],
            "OnBuild": null,
            "Labels": {
                "architecture": "x86_64",
                "build-date": "2025-02-17T07:21:18Z",
                "com.redhat.build-host": "",
                "com.redhat.component": "",
                "com.redhat.license_terms": "",
                "description": "Keycloak Server Image",
                "distribution-scope": "public",
                "io.buildah.version": "1.39.0-dev",
                "io.k8s.description": "Keycloak Server Image",
                "io.k8s.display-name": "Keycloak Server",
                "io.openshift.expose-services": "",
                "io.openshift.tags": "keycloak security identity",
                "maintainer": "https://www.keycloak.org/",
                "name": "keycloak",
                "org.opencontainers.image.created": "2025-02-20T14:46:41.871Z",
                "org.opencontainers.image.description": "",
                "org.opencontainers.image.documentation": "https://www.keycloak.org/documentation",
                "org.opencontainers.image.licenses": "Apache-2.0",
                "org.opencontainers.image.revision": "9dc36e6787c902eff4e74369e6a5fd3cd3798e1d",
                "org.opencontainers.image.source": "https://github.com/keycloak-rel/keycloak-rel",
                "org.opencontainers.image.title": "keycloak-rel",
                "org.opencontainers.image.url": "https://github.com/keycloak-rel/keycloak-rel",
                "org.opencontainers.image.version": "26.0.8",
                "release": "",
                "summary": "Keycloak Server Image",
                "url": "https://www.keycloak.org/",
                "vcs-ref": "",
                "vcs-type": "git",
                "vendor": "https://www.keycloak.org/",
                "version": "26.0.8"
            }
        },
        "Architecture": "amd64",
        "Os": "linux",
        "Size": 441678055,
        "GraphDriver": {
            "Data": {
                "LowerDir": "/var/lib/docker/overlay2/cb45a271a8425f2c30528a8273cf4191a9622324db54ec177232a0617c0d7734/diff:/var/lib/docker/overlay2/c6c9e98acab19a573bdd91bea372c80ecffe0a552fbdcdc3d84ac8922ca52ebb/diff:/var/lib/docker/overlay2/2174e2441279b9c41c4d83e79eda07c6cd39444fb8232926b735f7cec7cbad3d/diff:/var/lib/docker/overlay2/935753ae1175257dad3d7496310726311b461107e8b0a1d913077974ee185336/diff",
                "MergedDir": "/var/lib/docker/overlay2/6277e17fd7f8c9ca020df6bdb65247a8479a59d40f969bc90e93b55bbce3a3b4/merged",
                "UpperDir": "/var/lib/docker/overlay2/6277e17fd7f8c9ca020df6bdb65247a8479a59d40f969bc90e93b55bbce3a3b4/diff",
                "WorkDir": "/var/lib/docker/overlay2/6277e17fd7f8c9ca020df6bdb65247a8479a59d40f969bc90e93b55bbce3a3b4/work"
            },
            "Name": "overlay2"
        },
        "RootFS": {
            "Type": "layers",
            "Layers": [
                "sha256:456a106fc69abcc6e07bbd99e09cdb5b34d4bbd88f7043293e012be50189f055",
                "sha256:5b3e480c90b349ea4199a3f5fabf4f428325d8c4a1f809e5a605676ebe97dc08",
                "sha256:5350e392fb409c2b524bea30a6d5fead6851034c8251d58fcd465b16e4e73004",
                "sha256:adab456def56b37939bc6702c218f532045b596cbefbaa7403418499580f4a88",
                "sha256:b78d95c83e02cfbc1ac89989328ce8b716fd6e3e9e4edaaf9d0390a0da37dd05"
            ]
        },
        "Metadata": {
            "LastTagTime": "0001-01-01T00:00:00Z"
        }
    }
]

Do you regularly rebuild the Keycloak image? Why this rebuild? Are Keycloak images immutable?

Answered by shawkins

Apr 7, 2025

Do you regularly rebuild the Keycloak image?

No.

Why this rebuild?

To address a CVE.

Are Keycloak images immutable?

Images are immutable, tags are not. Tags such as 26.0, will move with a new micro release. And even a micro release tag like 26.0.x will move if that had been the latest release, but was rebuilt.

View full answer

shawkins · 2025-04-07T15:07:12Z

shawkins
Apr 7, 2025
Collaborator

Do you regularly rebuild the Keycloak image?

No.

Why this rebuild?

To address a CVE.

Are Keycloak images immutable?

Images are immutable, tags are not. Tags such as 26.0, will move with a new micro release. And even a micro release tag like 26.0.x will move if that had been the latest release, but was rebuilt.

2 replies

crtvmn Apr 7, 2025
Author

So tags X.Y.Z are not immutable. Should we use sha256 tag to install Keycloak? What are your recommendations for people installing the Keycloak Helm chart with the default tag version? Shouldn't they?
I understand "moving" digit for MAJOR.MINOR. But normally, MAJOR.MINOR.PATCH should be immutable as described in semver documentation: https://semver.org/#spec-item-3.

But thanks for these information. I'll take note of them and now I understand why the sha26 has changed for the 26.0.8 tag

shawkins Apr 7, 2025
Collaborator

These docker tags are not required to follow SemVer exactly nor were even designed with SemVer in mind -distribution/distribution#1201

The reasoning to keep the same micro release tag here is that the tag is referring to the Keycloak artifact version, not a differentiated Docker image version. When 26.0.8 is respun it is to pick up changes for something else in the Docker image build, such as Java - the Keycloak version remains as 26.0.8.

stianst · 2025-04-08T09:00:14Z

stianst
Apr 8, 2025
Maintainer

There's x.y.z tag that is updated in case the image is rebuilt, but there is also x.y.z-n tags that are not rebuilt. So either use the x.y.z-n tag or sha.

0 replies

Navigation Menu

Repository navigation

Keycloak images are not immutable #38687

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Keycloak images are not immutable #38687

Uh oh!

crtvmn Apr 4, 2025

Replies: 2 comments · 2 replies

Uh oh!

shawkins Apr 7, 2025 Collaborator

Uh oh!

crtvmn Apr 7, 2025 Author

Uh oh!

Uh oh!

shawkins Apr 7, 2025 Collaborator

Uh oh!

stianst Apr 8, 2025 Maintainer

crtvmn
Apr 4, 2025

Replies: 2 comments 2 replies

shawkins
Apr 7, 2025
Collaborator

crtvmn Apr 7, 2025
Author

shawkins Apr 7, 2025
Collaborator

stianst
Apr 8, 2025
Maintainer