pnpm

Each tag is a multi-arch index (amd64 + arm64) pinned by digest. Tagged by version, never :latest.

Use it as a base image

Reference it in the FROM line of your Dockerfile. Nonroot, read-only root filesystem, built for amd64 and arm64.

FROM ghcr.io/quenchworks/images/pnpm:12.9.1

Or pull it directly

docker pull ghcr.io/quenchworks/images/pnpm:12.9.1

Version line

12.9.1

Latest line

11.28.4, 12.9.1

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

License

MIT

Verify the supply chain

This image is cosign-signed and carries an SPDX SBOM and a SLSA build-provenance attestation on the same digest. Check all three before you build on it:

# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/pnpm:12.9.1 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/pnpm:12.9.1 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/pnpm:12.9.1 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

See the SBOM & provenance guide for reading the SBOM and using these checks in CI.

Best-practice Dockerfile for 12.9.1

pnpm leads: enabled here through corepack on the pnpm base, it resolves and locks the dependency set, builds, then a clean node base receives only the production node_modules and the built output.

1
# Build stage: pnpm resolves, locks, and builds (dev deps included here).
2
FROM ghcr.io/quenchworks/images/pnpm:12.9.1 AS build
3
USER root
4
WORKDIR /app
5
ENV PNPM_HOME=/tmp/pnpm
6

7
COPY package.json pnpm-lock.yaml ./
8
RUN ["pnpm", "install", "--frozen-lockfile"]
9
COPY . .
10
RUN ["pnpm", "run", "build"]
11
# Re-resolve to production-only for the runtime stage.
12
RUN ["pnpm", "install", "--prod", "--frozen-lockfile"]
13

14
# Runtime stage: prod node_modules + built dist on a slim node base, nonroot.
15
FROM ghcr.io/quenchworks/images/node:26.10.0 AS runtime
16
WORKDIR /app
17
ENV NODE_ENV=production
18
COPY --from=build /app/node_modules ./node_modules
19
COPY --from=build /app/dist ./dist
20
COPY --from=build /app/package.json ./package.json
21
USER 1001
22
EXPOSE 3000
23
CMD ["node", "dist/server.js"]

This Dockerfile is pinned to the 12.9.1 line. For the line-by-line walkthrough and ecosystem variants (npm/Yarn, pip/uv/Poetry, Maven/Gradle), see the Build a Node appguide.