SHA hash changed for Traefik image v3.7.13 in Docker Hub ?

Traefik
1

Hi there!

I noticed that the manifest SHA hash has changed in Docker hub for Traefik v3.7.13.

It went from:

docker.io/library/traefik:v3.7.13@sha256:96780238b1bbda5a9bb997f4307ce69e798ad1cf6eb7f2dcc0a440823467d199

to:

docker.io/library/traefik:v3.7.13@sha256:3429c14149401de2ac82fc72ddc6a92642332b90deb3012301ff211b9d2d0f18

...2 days ago.

Presumably this was just to pick up base OS updates without a change to Traefik itself. However, since this is exactly what a supply chain attack on the Docker image would look like (and I couldn't find an announcement about the change anywhere else), I wanted to double check before I updated my hash :slight_smile:

Thanks!

2

Hello @mig5 and thanks for checking,

This is expected. Traefik is a Docker Official Image, so Docker's team rebuilds it whenever its base image is updated. Alpine recently received CVE fixes, so v3.7.13 was rebuilt on top of it. The Traefik binary is unchanged; only the OS layers differ, which is why the digest changed.