Pin dockerfile dependencies by hash

[laurentsimon]

If you are reporting any crash or any potential security issue, do not
open an issue in this repo. Please report the issue via emailing
envoy-security@googlegroups.com where the issue will be triaged appropriately.

Title: Reduce attack surface by pinning docker dependencies by hash

Description:
scorecard reports

!! frozen-deps - .devcontainer/Dockerfile has non-pinned dependency 'gcr.io/envoy-ci/envoy-build:55d9e4719d2bd0accce8f829b44dab70cd42112a'
!! frozen-deps - ci/Dockerfile-envoy-alpine has non-pinned dependency 'frolvlad/alpine-glibc:alpine-3.12_glibc-2.31'
!! frozen-deps - ci/Dockerfile-envoy-distroless has non-pinned dependency 'gcr.io/distroless/base-debian10:nonroot'

Fix:
Pin dependencies by hash. Example here.
You can retrieve the digest corresponding to the dependencies thru:

$ docker pull <dep>
...
Digest: sha256:acf7795dc91df17e10effee064bd229580a9c34213b4dba578d64768af5d8c51
...

[asraa]

@lizan @phlax

[phlax]

this seems like a good idea - there was an issue recently with the alpine upstream image

my only concern is that if we pin to a particular version we probs also want to scan ~frequently that there are no issues with the pinned dep

@laurentsimon do you want to raise a PR to address the hashes ?

if not i can follow up

[laurentsimon]

@asraa volunteered to help, so I will let her send the PR. Thanks again @asraa !

[lizan]

There's a problem that sha256 hash differs by architecture, so it doesn't work for our multiarch image build.

[daixiang0]

I have experience about use SHA256 for different arches and can help if you need.

[phlax]

@daixiang0 do you have some idea how this can be achieved ? if so - please do open a PR and lets see

my quick internet search seems to confirm what @lizan has said - but i didnt find any definitive answers - nor any workarounds

[phlax]

regarding my concern about keeping up-to-date - it seems dependabot has support for dockerfiles so that is a non-issue i think

[daixiang0]

I would post soon.

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or "no stalebot" or other activity occurs. Thank you for your contributions.