pindock

Pin and update Docker image digests in Dockerfiles and compose files

Installation • Usage • Pre-commit

Installation

# PyPI
uv tool install pindock

# AUR
yay -S pindock-bin

# Docker
docker pull ghcr.io/deadnews/pindock

Usage

Usage: pindock <command> [flags]

Pin and update Docker image digests.

Commands:
  run      Pin unpinned image digests.
  check    Verify all images are pinned.

run flags:
  -C, --dir=.      Directory to scan.
  -u, --update     Also update tags and pinned digests to latest.
  -v, --verbose    Show all images, including pinned.

check flags:
  -C, --dir=.      Directory to scan.
  -u, --update     Also check tags and pinned digests for updates.
  -v, --verbose    Show all images, including pinned.

When no files are given, pindock auto-discovers files recursively.
latest and untagged images are pinned to the version tag pointing at the same digest (2.0.1 preferred over 2.0 and 2).
--update never moves a version tag past the version latest points to.
Prerelease tags (-rc, -alpha, -beta) update to the newest stable release once one is available; until then they follow their prerelease stream.

Supported files

Dockerfile, Containerfile (and variants like Dockerfile.dev, *.dockerfile)
compose*.yml, docker-compose*.yml (and .yaml)

Supported instructions

Dockerfile	Compose
`FROM [--platform=...] image:tag[@digest] [AS name]`	`image: image:tag[@digest]`
`COPY --from=image:tag[@digest] ...`
`RUN --mount=from=image:tag[@digest],... ...`

Authentication

Uses existing Docker credentials. If you can docker pull, pindock works too.

Pre-commit

repos:
  - repo: https://github.com/deadnews/pindock
    rev: v1.0.0
    hooks:
      - id: pindock
      - id: pindock-check

      # example with args
      - id: pindock-check
        args: [--update, --verbose]

Metadata

Release files for pindock 1.1.3

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Built distributions (wheels)

Table of built distributions (wheels) for pindock 1.1.3
File	Interpreter	ABI	Platform	Reset
pindock-1.1.3-py3-none-win_arm64.whl 3.9 MB Sep 29, 2026	Python 3	none	Windows ARM64	Details
pindock-1.1.3-py3-none-win_amd64.whl 4.4 MB Sep 29, 2026	Python 3	none	Windows x86-64	Details
pindock-1.1.3-py3-none-musllinux_1_2_x86_64.whl 4.3 MB Sep 29, 2026	Python 3	none	Linux musl 1.2+ x86-64	Details
pindock-1.1.3-py3-none-musllinux_1_2_aarch64.whl 3.8 MB Sep 29, 2026	Python 3	none	Linux musl 1.2+ ARM64	Details
pindock-1.1.3-py3-none-manylinux_2_17_x86_64.whl 4.3 MB Sep 29, 2026	Python 3	none	Linux glibc 2.17+ x86-64	Details
pindock-1.1.3-py3-none-manylinux_2_17_aarch64.whl 3.8 MB Sep 29, 2026	Python 3	none	Linux glibc 2.17+ ARM64	Details
pindock-1.1.3-py3-none-macosx_11_0_arm64.whl 4.0 MB Sep 29, 2026	Python 3	none	macOS 11.0+ ARM64	Details
pindock-1.1.3-py3-none-macosx_10_9_x86_64.whl 4.3 MB Sep 29, 2026	Python 3	none	macOS 10.9+ x86-64	Details

Total release size: 32.8 MB

Release files / pindock-1.1.3-py3-none-win_arm64.whl

Download URL	pindock-1.1.3-py3-none-win_arm64.whl
Size	3.9 MB
Tags	Python 3 Windows ARM64
SHA-256 checksum How to use checksums	`ab5ae170e4ca12736b17fd37b794c7c9003efaa5406ee0f9a5d24ec0d306cce8`
BLAKE2b-256 checksum How to use checksums	`ce0899b89b010c61b503202b7c0a2855c4d2c6b69fa3afa6021d32c9d9daa09f`
Upload date	Sep 29, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/deadnews/pindock
Publishing commit: github.com/deadnews/pindock/tree/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922

Workflow

Publishing configuration: github.com/deadnews/pindock/blob/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922/.github/workflows/main.yml
Publishing logs: github.com/deadnews/pindock/actions/runs/36602835399/attempts/1

Artifact

Subject: pindock-1.1.3-py3-none-win_arm64.whl
SHA-256 checksum: ab5ae170e4ca12736b17fd37b794c7c9003efaa5406ee0f9a5d24ec0d306cce8 Verifying attestations

Release files / pindock-1.1.3-py3-none-win_amd64.whl

Download URL	pindock-1.1.3-py3-none-win_amd64.whl
Size	4.4 MB
Tags	Python 3 Windows x86-64
SHA-256 checksum How to use checksums	`18d68e2c3a9fe21ff3d3ee49e7042c9d97628dddf428ee22b99f40af1cdefe47`
BLAKE2b-256 checksum How to use checksums	`806045879cd5f6193cfadd774d433a70eefad3e31c17be40a842da8cd86d859e`
Upload date	Sep 29, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/deadnews/pindock
Publishing commit: github.com/deadnews/pindock/tree/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922

Workflow

Publishing configuration: github.com/deadnews/pindock/blob/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922/.github/workflows/main.yml
Publishing logs: github.com/deadnews/pindock/actions/runs/36602835399/attempts/1

Artifact

Subject: pindock-1.1.3-py3-none-win_amd64.whl
SHA-256 checksum: 18d68e2c3a9fe21ff3d3ee49e7042c9d97628dddf428ee22b99f40af1cdefe47 Verifying attestations

Release files / pindock-1.1.3-py3-none-musllinux_1_2_x86_64.whl

Download URL	pindock-1.1.3-py3-none-musllinux_1_2_x86_64.whl
Size	4.3 MB
Tags	Linux musl 1.2+ x86-64 Python 3
SHA-256 checksum How to use checksums	`482618a93c405c8c0343b4bee27043a56ee3723b214a0479fd98e24a53dfcb88`
BLAKE2b-256 checksum How to use checksums	`92d3fa672ac754c216d3905ae87b26c0f9e7e2804b503ebabd56df4dfae9cc28`
Upload date	Sep 29, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/deadnews/pindock
Publishing commit: github.com/deadnews/pindock/tree/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922

Workflow

Publishing configuration: github.com/deadnews/pindock/blob/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922/.github/workflows/main.yml
Publishing logs: github.com/deadnews/pindock/actions/runs/36602835399/attempts/1

Artifact

Subject: pindock-1.1.3-py3-none-musllinux_1_2_x86_64.whl
SHA-256 checksum: 482618a93c405c8c0343b4bee27043a56ee3723b214a0479fd98e24a53dfcb88 Verifying attestations

Release files / pindock-1.1.3-py3-none-musllinux_1_2_aarch64.whl

Download URL	pindock-1.1.3-py3-none-musllinux_1_2_aarch64.whl
Size	3.8 MB
Tags	Linux musl 1.2+ ARM64 Python 3
SHA-256 checksum How to use checksums	`50ae151c66d13d51b702a055c8c5a646bb245d6de3db6be9194b9bfe6f37c98a`
BLAKE2b-256 checksum How to use checksums	`4ef264ae04afbede00d1c8222631ce0f2d47b322d34561e5566045dfe8772041`
Upload date	Sep 29, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/deadnews/pindock
Publishing commit: github.com/deadnews/pindock/tree/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922

Workflow

Publishing configuration: github.com/deadnews/pindock/blob/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922/.github/workflows/main.yml
Publishing logs: github.com/deadnews/pindock/actions/runs/36602835399/attempts/1

Artifact

Subject: pindock-1.1.3-py3-none-musllinux_1_2_aarch64.whl
SHA-256 checksum: 50ae151c66d13d51b702a055c8c5a646bb245d6de3db6be9194b9bfe6f37c98a Verifying attestations

Release files / pindock-1.1.3-py3-none-manylinux_2_17_x86_64.whl

Download URL	pindock-1.1.3-py3-none-manylinux_2_17_x86_64.whl
Size	4.3 MB
Tags	Linux glibc 2.17+ x86-64 Python 3
SHA-256 checksum How to use checksums	`660cc8551a9d5ebf09765ca0a982de41422c6ee1da021e1593b5e27ba9360274`
BLAKE2b-256 checksum How to use checksums	`e8c583a5dca4650b2a2d9723d26d42cc133575a60ec3e9bbac2ca7c04f0b9bb5`
Upload date	Sep 29, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/deadnews/pindock
Publishing commit: github.com/deadnews/pindock/tree/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922

Workflow

Publishing configuration: github.com/deadnews/pindock/blob/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922/.github/workflows/main.yml
Publishing logs: github.com/deadnews/pindock/actions/runs/36602835399/attempts/1

Artifact

Subject: pindock-1.1.3-py3-none-manylinux_2_17_x86_64.whl
SHA-256 checksum: 660cc8551a9d5ebf09765ca0a982de41422c6ee1da021e1593b5e27ba9360274 Verifying attestations

Release files / pindock-1.1.3-py3-none-manylinux_2_17_aarch64.whl

Download URL	pindock-1.1.3-py3-none-manylinux_2_17_aarch64.whl
Size	3.8 MB
Tags	Linux glibc 2.17+ ARM64 Python 3
SHA-256 checksum How to use checksums	`7e742477e7f20c92954217fe2fc93b89fc6baff7988a589818073fb7e660494d`
BLAKE2b-256 checksum How to use checksums	`2a60793cac4e1f346594c864498807b947ba47c3e86d98267e55b776a687f5e7`
Upload date	Sep 29, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/deadnews/pindock
Publishing commit: github.com/deadnews/pindock/tree/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922

Workflow

Publishing configuration: github.com/deadnews/pindock/blob/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922/.github/workflows/main.yml
Publishing logs: github.com/deadnews/pindock/actions/runs/36602835399/attempts/1

Artifact

Subject: pindock-1.1.3-py3-none-manylinux_2_17_aarch64.whl
SHA-256 checksum: 7e742477e7f20c92954217fe2fc93b89fc6baff7988a589818073fb7e660494d Verifying attestations

Release files / pindock-1.1.3-py3-none-macosx_11_0_arm64.whl

Download URL	pindock-1.1.3-py3-none-macosx_11_0_arm64.whl
Size	4.0 MB
Tags	Python 3 macOS 11.0+ ARM64
SHA-256 checksum How to use checksums	`1209cebcb7d9b33ce6c1fa578ff12fc322f981bd2bad9bd44fc114f0606883c7`
BLAKE2b-256 checksum How to use checksums	`dea0d4adbb673cbf4854813618594deed65acf441b027e954fef59bcec2329d2`
Upload date	Sep 29, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/deadnews/pindock
Publishing commit: github.com/deadnews/pindock/tree/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922

Workflow

Publishing configuration: github.com/deadnews/pindock/blob/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922/.github/workflows/main.yml
Publishing logs: github.com/deadnews/pindock/actions/runs/36602835399/attempts/1

Artifact

Subject: pindock-1.1.3-py3-none-macosx_11_0_arm64.whl
SHA-256 checksum: 1209cebcb7d9b33ce6c1fa578ff12fc322f981bd2bad9bd44fc114f0606883c7 Verifying attestations

Release files / pindock-1.1.3-py3-none-macosx_10_9_x86_64.whl

Download URL	pindock-1.1.3-py3-none-macosx_10_9_x86_64.whl
Size	4.3 MB
Tags	Python 3 macOS 10.9+ x86-64
SHA-256 checksum How to use checksums	`f65bf708da0d23f08e113a3c1dfbf1bb9a7e521cc9cda78bd6bcc5331966770b`
BLAKE2b-256 checksum How to use checksums	`09e52a87d7b2d872cf707674487b3734b1ce0476fd3cb39c5da3a737a62677e5`
Upload date	Sep 29, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/deadnews/pindock
Publishing commit: github.com/deadnews/pindock/tree/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922

Workflow

Publishing configuration: github.com/deadnews/pindock/blob/9ff7e9deaa8bf519e3dfb3df1c0315676f4db922/.github/workflows/main.yml
Publishing logs: github.com/deadnews/pindock/actions/runs/36602835399/attempts/1

Artifact

Subject: pindock-1.1.3-py3-none-macosx_10_9_x86_64.whl
SHA-256 checksum: f65bf708da0d23f08e113a3c1dfbf1bb9a7e521cc9cda78bd6bcc5331966770b Verifying attestations