From 6538dd4fae1e7ed8aa60568def5d7d31c898e959 Mon Sep 17 00:00:00 2001
From: clawbot <clawbot@noreply.example.org>
Date: Sun, 22 Feb 2026 18:05:02 +0100
Subject: [PATCH] fix: pin ruby base by sha256, add wrangler+prettier, use
 apt-get (closes #1)

---
 Dockerfile | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 60ff149..8912b8d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,7 @@
-FROM ruby:3.1-bullseye AS builder
+# ruby:3.1-bullseye, pinned 2026-02-22
+FROM ruby@sha256:4cc0e5aaa726f8c2cbf1dfc8e5ecd459dbfbebe44b5eee5da6f79ffcc1b6c36f AS builder
 
-RUN apt update && apt install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     bsdmainutils \
     build-essential \
     make \
@@ -11,7 +12,8 @@ RUN apt update && apt install -y \
     libxslt-dev \
     pkg-config \
     python3 \
-    xz-utils
+    xz-utils \
+    && rm -rf /var/lib/apt/lists/*
 
 # Node.js 20.18.3 LTS, pinned by sha256
 RUN cd /tmp && \
@@ -21,11 +23,12 @@ RUN cd /tmp && \
     rm node-v20.18.3-linux-x64.tar.xz
 
 RUN npm install -g yarn && \
-    yarn global add prettier
+    yarn global add prettier && \
+    npm install -g wrangler
 
 ADD ./Gemfile* ./
 
 RUN echo "gem: --no-ri --no-rdoc" > ~/.gemrc && \
     yes | gem update --system && \
     gem install bundler && \
-    bundle install
+    bundle install
\ No newline at end of file