Chore: Make base images in Dockerfile dependabot-friendly (#106792)

.drone.yml

@@ -201,7 +201,7 @@ steps:
     -a targz:grafana:linux/arm/v7 -a docker:grafana:linux/amd64 -a docker:grafana:linux/amd64:ubuntu
     -a docker:grafana:linux/arm64 -a docker:grafana:linux/arm64:ubuntu -a docker:grafana:linux/arm/v7
     -a docker:grafana:linux/arm/v7:ubuntu --yarn-cache=$$YARN_CACHE_FOLDER --build-id=$$DRONE_BUILD_NUMBER
-    --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.21.3 --tag-format='{{ .version_base
+    --ubuntu-base=ubuntu-base --alpine-base=alpine-base --tag-format='{{ .version_base
     }}-{{ .buildID }}-{{ .arch }}' --ubuntu-tag-format='{{ .version_base }}-{{ .buildID
     }}-ubuntu-{{ .arch }}' --verify='false' --grafana-dir=$$PWD > packages.txt
   - find ./dist -name '*docker*.tar.gz' -type f | xargs -n1 docker load -i
@@ -668,7 +668,7 @@ steps:
     -a targz:grafana:linux/arm/v7 -a docker:grafana:linux/amd64 -a docker:grafana:linux/amd64:ubuntu
     -a docker:grafana:linux/arm64 -a docker:grafana:linux/arm64:ubuntu -a docker:grafana:linux/arm/v7
     -a docker:grafana:linux/arm/v7:ubuntu --yarn-cache=$$YARN_CACHE_FOLDER --build-id=$$DRONE_BUILD_NUMBER
-    --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.21.3 --tag-format='{{ .version_base
+    --ubuntu-base=ubuntu-base --alpine-base=alpine-base --tag-format='{{ .version_base
     }}-{{ .buildID }}-{{ .arch }}' --ubuntu-tag-format='{{ .version_base }}-{{ .buildID
     }}-ubuntu-{{ .arch }}' --verify='false' --grafana-dir=$$PWD > packages.txt
   - find ./dist -name '*docker*.tar.gz' -type f | xargs -n1 docker load -i
@@ -2984,6 +2984,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: 6dad99efcf9a41b8964e347e66d4e33861d6d08871294ed70033e4b653963dfd
+hmac: db5485c680a21c2f4032064cd7fd892a3075ebd92cd29422d892fcc375eb6948
 
 ...

Dockerfile

@@ -3,15 +3,22 @@
 # to maintain formatting of multiline commands in vscode, add the following to settings.json:
 # "docker.languageserver.formatter.ignoreMultilineInstructions": true
 
-ARG BASE_IMAGE=alpine:3.21
-ARG JS_IMAGE=node:22-alpine
+ARG BASE_IMAGE=alpine-base
+ARG GO_IMAGE=go-builder-base
+ARG JS_IMAGE=js-builder-base
 ARG JS_PLATFORM=linux/amd64
-ARG GO_IMAGE=golang:1.24.4-alpine
 
 # Default to building locally
 ARG GO_SRC=go-builder
 ARG JS_SRC=js-builder
 
+# Dependabot cannot update dependencies listed in ARGs
+# By using FROM instructions we can delegate dependency updates to dependabot
+FROM alpine:3.21.3 AS alpine-base
+FROM ubuntu:22.04 AS ubuntu-base
+FROM golang:1.24.4-alpine AS go-builder-base
+FROM --platform=${JS_PLATFORM} node:22-alpine AS js-builder-base
+
 # Javascript build stage
 FROM --platform=${JS_PLATFORM} ${JS_IMAGE} AS js-builder
 

pkg/build/daggerbuild/arguments/docker.go

@@ -19,13 +19,13 @@ var (
 	}
 	AlpineImageFlag = &cli.StringFlag{
 		Name:  "alpine-base",
-		Usage: "The alpine image to use as the base image when building the Alpine version of the Grafana docker image",
-		Value: "alpine:latest",
+		Usage: "The image or image alias specified in the Dockerfile to be used as the base image when building the Alpine version of the Grafana docker image.",
+		Value: "alpine-base",
 	}
 	UbuntuImageFlag = &cli.StringFlag{
 		Name:  "ubuntu-base",
-		Usage: "The Ubuntu image to use as the base image when building the Ubuntu version of the Grafana docker image",
-		Value: "ubuntu:latest",
+		Usage: "The image or image alias specified in the Dockerfile to be used as the base image when building the Ubuntu version of the Grafana docker image",
+		Value: "ubuntu-base",
 	}
 	TagFormatFlag = &cli.StringFlag{
 		Name:  "tag-format",

scripts/drone/pipelines/build.star

@@ -37,10 +37,6 @@ load(
     "scripts/drone/steps/rgm.star",
     "rgm_artifacts_step",
 )
-load(
-    "scripts/drone/utils/images.star",
-    "images",
-)
 load(
     "scripts/drone/utils/utils.star",
     "pipeline",
@@ -73,7 +69,6 @@ def build_e2e(trigger, ver_mode):
     build_steps = []
 
     create_packages = rgm_artifacts_step(
-        alpine = images["alpine"],
         artifacts = [
             "targz:grafana:linux/amd64",
             "targz:grafana:linux/arm64",
@@ -87,7 +82,6 @@ def build_e2e(trigger, ver_mode):
         ],
         file = "packages.txt",
         tag_format = "{{ .version_base }}-{{ .buildID }}-{{ .arch }}",
-        ubuntu = images["ubuntu"],
         ubuntu_tag_format = "{{ .version_base }}-{{ .buildID }}-ubuntu-{{ .arch }}",
     )
 

scripts/drone/steps/rgm.star

@@ -37,9 +37,7 @@ def rgm_artifacts_step(
         depends_on = ["yarn-install"],
         tag_format = "{{ .version }}-{{ .arch }}",
         ubuntu_tag_format = "{{ .version }}-ubuntu-{{ .arch }}",
-        verify = "false",
-        ubuntu = images["ubuntu"],
-        alpine = images["alpine"]):
+        verify = "false"):
     cmd = artifacts_cmd(artifacts = artifacts)
 
     return {
@@ -57,8 +55,8 @@ def rgm_artifacts_step(
             cmd +
             "--yarn-cache=$$YARN_CACHE_FOLDER " +
             "--build-id=$$DRONE_BUILD_NUMBER " +
-            "--ubuntu-base={} ".format(ubuntu) +
-            "--alpine-base={} ".format(alpine) +
+            "--ubuntu-base=ubuntu-base " +
+            "--alpine-base=alpine-base " +
             "--tag-format='{}' ".format(tag_format) +
             "--ubuntu-tag-format='{}' ".format(ubuntu_tag_format) +
             "--verify='{}' ".format(verify) +
@@ -68,13 +66,11 @@ def rgm_artifacts_step(
         "volumes": [{"name": "docker", "path": "/var/run/docker.sock"}],
     }
 
-# rgm_build_backend will create compile the grafana backend for various platforms. It's preferred to use
-# 'rgm_package_step' if you creating a "usable" artifact. This should really only be used to verify that the code is
-# compilable.
+# rgm_build_backend will create compile the grafana backend for various platforms.
 def rgm_build_backend_step(artifacts = ["backend:grafana:linux/amd64", "backend:grafana:linux/arm64"]):
     return rgm_artifacts_step(name = "rgm-build-backend", artifacts = artifacts, depends_on = [])
 
-def rgm_build_docker_step(ubuntu, alpine, depends_on = ["yarn-install"], file = "docker.txt", tag_format = "{{ .version }}-{{ .arch }}", ubuntu_tag_format = "{{ .version }}-ubuntu-{{ .arch }}"):
+def rgm_build_docker_step(depends_on = ["yarn-install"], file = "docker.txt", tag_format = "{{ .version }}-{{ .arch }}", ubuntu_tag_format = "{{ .version }}-ubuntu-{{ .arch }}"):
     return {
         "name": "rgm-build-docker",
         "image": images["go"],
@@ -95,8 +91,8 @@ def rgm_build_docker_step(ubuntu, alpine, depends_on = ["yarn-install"], file =
             "-a docker:grafana:linux/arm/v7:ubuntu " +
             "--yarn-cache=$$YARN_CACHE_FOLDER " +
             "--build-id=$$DRONE_BUILD_NUMBER " +
-            "--ubuntu-base={} ".format(ubuntu) +
-            "--alpine-base={} ".format(alpine) +
+            "--ubuntu-base=ubuntu-base " +
+            "--alpine-base=alpine-base " +
             "--tag-format='{}' ".format(tag_format) +
             "--grafana-dir=$$PWD " +
             "--ubuntu-tag-format='{}' > {}".format(ubuntu_tag_format, file),