# CI helper image register (digest-pinned)

Rules:
- Workflows MUST reference helper images by index digest (`@sha256:...`), never by bare tag.
- Every bake updates the table below and pushes `est/<name>:vN` (tag kept for humans; digest is the identity).
- Bake Dockerfiles live under `tools/ci/helper/` (to be added in P1; current images were baked on tn by zcode during M1-416).

| name | tag | index digest | amd64 manifest digest | size | contents |
|---|---|---|---|---|---|
| ci-node-bookworm | v1 | sha256:78c01b0be47ebc60c0fa940110d66c60ca4e57f0fa57178bb88788e4ea131b61 | sha256:76cf59f18cca34a25c864b9305f42983e56aa5d3c918657827822a83d794dc35 | 585MB | node + mirrored apt, docker-ce-cli (tuna docker-ce apt, GPG-verified), chromium runtime GUI libs, git/perl (F1 foundation) |
| ci-node-alpine | v1 | sha256:a08d2cea4d69e3cf831be410e5e62a72a55a9bf8e9b0c3fcef4df553f9f181e6 | sha256:f4795742c2e53d6df221659af81a385e887d60873637ba34ce36c86f13261a6c | 86MB | node + alpine docker-cli, mirrors pre-swapped (F2) |

## Usage conventions (proven on the business-repo pipelines)

- Mounts (verify/build containers): docker.sock, `$HOME/.docker/config.json` (ro), host CA (ro), host buildx plugin (ro), workspace.
- Env: `SSL_CERT_FILE` + `NODE_EXTRA_CA_CERTS` point at the mounted CA.
- Cache dirs: directory level 0777 only; never `chmod -R` (selection files are validated 0600).
- Registry references: bare repo + `@digest` (docker 29 rejects `repo:tag@digest`).

## TODO (P1)
- Add the two Dockerfiles under `tools/ci/helper/` so rebakes are reproducible.
- Record bake receipts (apt/apk mirror used, timings) per bake in a changelog.