From 150208fc722185dbe135294f65e0bf08a5e0737e Mon Sep 17 00:00:00 2001
From: Thomas Leonard <thomas.leonard@unikernel.com>
Date: Tue, 31 Jan 2017 09:26:57 +0000
Subject: [PATCH] Pin Docker base image to a specific hash

Requested by Joanna Rutkowska.
---
 Dockerfile | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 9424fc7..2182d1e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,12 @@
-FROM ocaml/opam:debian-8_ocaml-4.03.0
+# Pin the base image to a specific hash for maximum reproducibility.
+# It will probably still work on newer images, though, unless Debian 8
+# changes some compiler optimisations (unlikely).
+#FROM ocaml/opam:debian-8_ocaml-4.03.0
+FROM ocaml/opam@sha256:28efab6a5535a517aa719ba5ac6d2e6fddd4831afaeabf5eee6470717eda9cca
 
 # Pin last known-good version for reproducible builds.
-# Remove this line if you want to test with the latest versions.
+# Remove this line (and the base image pin above) if you want to test with the
+# latest versions.
 RUN cd opam-repository && git reset --hard 0f17b354206c97e729700ce60ddce3789ccb1d52 && opam update
 
 RUN sudo apt-get install -y m4 libxen-dev