From 9e205ad37ba33f966ff286425aa08841488d90e2 Mon Sep 17 00:00:00 2001 From: Gabriel Dugny Date: Wed, 12 Aug 2026 11:19:09 +0200 Subject: [PATCH 1/3] build: take the plantuml jar from the official image The jar was curl'd from a GitHub release and validated against a sha1sum that had to be regenerated by hand on every bump, so Renovate could not touch it. plantuml/plantuml packages the same release, and a tag + digest pin on COPY --from is something Renovate updates like any other image. Also replaces the `echo $'...'` wrapper with printf. $'' is a bashism: it happens to work under busybox ash here, but a shell without it writes a literal `$` into the shebang, which is the Exec format error the comment above the RUN warns about for the Backstage Backend container. printf behaves the same everywhere, so the warning keeps its point but no longer needs a second RUN variant to copy. `>` instead of `>>` also stops a layer rebuild from concatenating two scripts into the file. Verified with a local build for the pinned digest (multi-arch index, so the linux/arm64 leg still resolves): `plantuml -version` reports 1.2026.2, and `mkdocs build` on mock-docs renders the diagram. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Gabriel Dugny --- Dockerfile | 20 ++++++++++---------- README.md | 10 ++++++---- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/Dockerfile b/Dockerfile index c8870da..3a50ad8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,24 +16,24 @@ FROM python:3.14-alpine@sha256:26730869004e2b9c4b9ad09cab8625e81d256d1ce97e72df5 RUN apk update && apk --no-cache add gcc musl-dev openjdk17-jdk curl graphviz ttf-dejavu fontconfig -# Download plantuml file, Validate checksum & Move plantuml file -RUN curl -o plantuml.jar -L https://github.com/plantuml/plantuml/releases/download/v1.2026.2/plantuml-1.2026.2.jar \ - && echo "55884e11f3f1075d4778a9ebaa9244d530a74391 plantuml.jar" | sha1sum -c - && mv plantuml.jar /opt/plantuml.jar +# Take the plantuml jar from the official image, pinned by tag and digest so Renovate +# keeps it updated. +COPY --from=plantuml/plantuml:1.2026.2@sha256:711a0cdf56a46d9bfac8fcc4c08872cd47e1bd31cd87f2d0268ebe75a6b100ee \ + /opt/plantuml.jar /opt/plantuml.jar COPY requirements.txt . RUN pip install --upgrade pip && pip install -r requirements.txt # Create script to call plantuml.jar from a location in path -# When adding TechDocs to the Backstage Backend container, avoid this -# error (OSError: [Errno 8] Exec format error: 'plantuml') by using the -# following RUN command instead: -# RUN echo '#!/bin/sh\n\njava -jar '/opt/plantuml.jar' ${@}' >> /usr/local/bin/plantuml +# printf is what avoids this error (OSError: [Errno 8] Exec format error: 'plantuml') +# when adding TechDocs to the Backstage Backend container: shells without $'' support, +# eg. dash, write a literal `$` into the shebang from `echo $'...'`. # When adding TechDocs with PlantUML diagrams, to refer external puml or pu files in any markdown file, # eg. '!include ', you'll need to include the diagrams directory eg. docs in the classpath. # Use following RUN command instead: -# RUN echo $'#!/bin/sh\n\njava -Dplantuml.include.path=${diagramDir} -jar '/opt/plantuml.jar ' ${@}' >> /usr/local/bin/plantuml -RUN echo $'#!/bin/sh\n\njava -jar '/opt/plantuml.jar' ${@}' >> /usr/local/bin/plantuml -RUN chmod 755 /usr/local/bin/plantuml +# RUN printf '#!/bin/sh\nexec java -Dplantuml.include.path=${diagramDir} -jar /opt/plantuml.jar "$@"\n' > /usr/local/bin/plantuml && chmod 755 /usr/local/bin/plantuml +RUN printf '#!/bin/sh\nexec java -jar /opt/plantuml.jar "$@"\n' > /usr/local/bin/plantuml \ + && chmod 755 /usr/local/bin/plantuml ENTRYPOINT [ "mkdocs" ] diff --git a/README.md b/README.md index 765551e..bb35086 100644 --- a/README.md +++ b/README.md @@ -34,8 +34,10 @@ Note: The `latest` tag on DockerHub points to the recent commits in the `main` b ## Updating PlantUML -PlantUML is a Java based tool which is packaged in a single JAR file. You can find the latest released in their [GitHub repo under Releases](https://github.com/plantuml/plantuml/releases). When updating the Docker file with a new release of PlantUML you'll need to download the relevant JAR file first and then generate a checksum using `sha1sum`. Here are the steps: +PlantUML is a Java based tool which is packaged in a single JAR file. The Dockerfile takes the JAR from the official [`plantuml/plantuml`](https://hub.docker.com/r/plantuml/plantuml) image, pinned by tag and digest, so Renovate opens the update PR and no checksum needs to be maintained by hand. -1. Download the JAR file: `curl -o plantuml.jar -L https://github.com/plantuml/plantuml/releases/download/v1.2024.6/plantuml-1.2024.6.jar` -2. Generate the checksum: `sha1sum plantuml.jar` -3. Update the Dockerfile file with the proper release URL and checksum +To bump it manually, update both the tag and the digest on the `COPY --from=plantuml/plantuml:...` line. Get the digest for a version with: + +```bash +docker buildx imagetools inspect plantuml/plantuml:1.2026.2 +``` From 5df2b88d46586afdacceaf996c462602d256aa95 Mon Sep 17 00:00:00 2001 From: Gabriel Dugny Date: Wed, 12 Aug 2026 11:21:39 +0200 Subject: [PATCH 2/3] build: drop the pip cache from the image pip install wrote 31.5 MB of wheels and cached response bodies to /root/.cache/pip, which the layer then kept forever. Nothing in the container reads it: the install runs once at build time. Image goes from 737 MB to 705 MB. A ~1 MB http-v2 remainder survives --no-cache-dir, so it is not worth an extra rm. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Gabriel Dugny --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 3a50ad8..de0408b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -22,7 +22,7 @@ COPY --from=plantuml/plantuml:1.2026.2@sha256:711a0cdf56a46d9bfac8fcc4c08872cd47 /opt/plantuml.jar /opt/plantuml.jar COPY requirements.txt . -RUN pip install --upgrade pip && pip install -r requirements.txt +RUN pip install --no-cache-dir --upgrade pip && pip install --no-cache-dir -r requirements.txt # Create script to call plantuml.jar from a location in path # printf is what avoids this error (OSError: [Errno 8] Exec format error: 'plantuml') From 18f6c782440ffd7274ef87ff48211f2be2ff4ec5 Mon Sep 17 00:00:00 2001 From: Gabriel Dugny Date: Wed, 12 Aug 2026 11:25:40 +0200 Subject: [PATCH 3/3] chore: let renovate manage the github actions config:best-practices already extends helpers:pinGitHubActionDigests, but enabledManagers left out github-actions, so that half of the preset was dead config and no workflow pin has moved since it was written. The workflows are 1-3 majors behind as a result, including actions/checkout@v2 and actions/stale@v4.1.1. Expect the first run to open a batch of PRs: major bumps plus SHA pins for every action, per the preset already in use. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Gabriel Dugny --- renovate.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 578a622..2d47c1b 100644 --- a/renovate.json +++ b/renovate.json @@ -9,7 +9,8 @@ ], "enabledManagers": [ "dockerfile", - "pip_requirements" + "pip_requirements", + "github-actions" ], "packageRules": [ {