Do image digests work in pipes?

Question

When providing an image for example like this:

- pipe: sonarsource/sonarqube-scan:2.0.1@sha256:f559720fcbb3bc355b9599666525c3ad80d6b6ab25ecd53aabb029aa583139a
We get an error in the pipeline:Configuration error

It looks like you tried to use a pipe in your bitbucket-pipelines.yml that doesn’t exist. Check the name of the pipe and try again.

(pulling this image locally works without any problems)

But using something like:

- pipe: sonarsource/sonarqube-scan:2.0.1

Does work without any problems. Is there any reason why not to allow to use these digests to improve security?

Patrik S · Accepted Answer

Hey @Mees Kluivers , and welcome to the Community! Using digests in the pipe image definition is actually possible, but the syntax is slightly different from what you shared in your description. When defining a custom docker image as a pipe, you need to prepend it with docker://: pipe: docker:///:@ Essentially, every pipe is a Docker container with an entry point script that contains the logic. Following is an example of how it would look like using the sonarqube scan image you mentioned: - step: name: Test pipe script: - echo "Test" - pipe: docker://sonarsource/sonarqube-scan:2.0.1@sha256:f559720fcbb3bc355b9599666525c3ad80d6b6ab25ecd53aabb029aa583139a7 variables: - Reference: Custom pipes I hope that helps! Should you have any questions, feel free to ask. Thank you, @Mees Kluivers ! Patrik S