pinker

piñker 🧷

Secure your container supply chain by automatically pinning Docker images to immutable SHA256 digests.

[!TIP] Tags are mutable. Digests are forever.

Why Pinker?

Mutable tags like postgres:14 or node:latest can change at any time. Pinker resolves these tags to their exact SHA256 digest, ensuring your builds are:

• Reproducible: Everyone builds the exact same image, every time.
• Secure: Protects against tag hijacking or unexpected upstream changes.

Features

• Zero-Config Authentication Seamlessly reuses your local Docker credentials. If docker login registry.example.com works in your terminal, pinker works automatically. No need to manage extra secrets.
• Multi-Registry Support Built on top of standard OCI libraries with native support for AWS ECR, Google Artifact Registry, Azure ACR, Harbor, and any OCI-compliant private registry.
• Immutable by Design Converts uncertain tags (e.g., latest) into deterministic SHA256 digests, locking your infrastructure to a specific state.
• Broad Compatibility Works out-of-the-box with Dockerfile and docker-compose.yml (supports .yaml, compose.yml, and other standard naming conventions).

Install

Binaries (Recommended)

Download the pre-compiled binaries for your platform from the Releases page.

Go Install

If you have Go installed, you can build and install the latest version from source:

go install github.com/honeok/pinker@latest

Usage

# Pin everything in the current directory (recursive)
$ pinker

# Pin a specific directory
$ pinker ./deploy

Acknowledgements

This project is heavily inspired by pinata by caarlos0. The code structure, design philosophy, and CLI experience are directly adapted from his work to bring the same security and reproducibility standards to the Docker ecosystem.