From 153b6af94eebd9bf9115bec2ebed840490bd5b9f Mon Sep 17 00:00:00 2001 From: Carles Capell Date: Tue, 29 Sep 2026 18:22:47 +0200 Subject: [PATCH 1/4] build(nodejs_lambda): move critical-path builds off public.ecr.aws --- .../docker/nodejs_lambda/docker-bake.hcl | 21 +++++++++++++++++++ .../nodejs_lambda/nodejs-alb-multi.Dockerfile | 8 +------ .../nodejs_lambda/nodejs-alb.Dockerfile | 8 +------ .../nodejs-apigw-http.Dockerfile | 8 +------ .../nodejs-apigw-rest.Dockerfile | 8 +------ .../nodejs-function-url.Dockerfile | 8 +------ .../nodejs_lambda/runtime.base.Dockerfile | 10 +++++++++ 7 files changed, 36 insertions(+), 35 deletions(-) create mode 100644 utils/build/docker/nodejs_lambda/docker-bake.hcl create mode 100644 utils/build/docker/nodejs_lambda/runtime.base.Dockerfile diff --git a/utils/build/docker/nodejs_lambda/docker-bake.hcl b/utils/build/docker/nodejs_lambda/docker-bake.hcl new file mode 100644 index 00000000000..e93f5245e31 --- /dev/null +++ b/utils/build/docker/nodejs_lambda/docker-bake.hcl @@ -0,0 +1,21 @@ +# Docker Buildx bake file for nodejs_lambda base images +# +# `context` is always this directory: base image Dockerfiles only COPY files from +# here, so paths in the Dockerfile are relative to it (see build_base_images.py, +# which derives base_image_dependencies from these COPY instructions). + +group "default" { + targets = [ + "runtime", + ] +} + +target "_common" { + context = "." +} + +target "runtime" { + inherits = ["_common"] + dockerfile = "runtime.base.Dockerfile" + tags = ["datadog/system-tests:nodejs-lambda-runtime.base"] +} diff --git a/utils/build/docker/nodejs_lambda/nodejs-alb-multi.Dockerfile b/utils/build/docker/nodejs_lambda/nodejs-alb-multi.Dockerfile index d5d189e148a..52ba85e1754 100644 --- a/utils/build/docker/nodejs_lambda/nodejs-alb-multi.Dockerfile +++ b/utils/build/docker/nodejs_lambda/nodejs-alb-multi.Dockerfile @@ -1,10 +1,4 @@ -FROM public.ecr.aws/lambda/nodejs:18 - -RUN yum install -y unzip findutils socat && yum clean all - -# Add the Datadog Extension -RUN mkdir -p /opt/extensions -COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/ +FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/ RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh diff --git a/utils/build/docker/nodejs_lambda/nodejs-alb.Dockerfile b/utils/build/docker/nodejs_lambda/nodejs-alb.Dockerfile index bb0e74b1fa7..30dd76bb824 100644 --- a/utils/build/docker/nodejs_lambda/nodejs-alb.Dockerfile +++ b/utils/build/docker/nodejs_lambda/nodejs-alb.Dockerfile @@ -1,10 +1,4 @@ -FROM public.ecr.aws/lambda/nodejs:18 - -RUN yum install -y unzip findutils socat && yum clean all - -# Add the Datadog Extension -RUN mkdir -p /opt/extensions -COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/ +FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/ RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh diff --git a/utils/build/docker/nodejs_lambda/nodejs-apigw-http.Dockerfile b/utils/build/docker/nodejs_lambda/nodejs-apigw-http.Dockerfile index b57a0e362af..c66cee8069d 100644 --- a/utils/build/docker/nodejs_lambda/nodejs-apigw-http.Dockerfile +++ b/utils/build/docker/nodejs_lambda/nodejs-apigw-http.Dockerfile @@ -1,10 +1,4 @@ -FROM public.ecr.aws/lambda/nodejs:18 - -RUN yum install -y unzip findutils socat && yum clean all - -# Add the Datadog Extension -RUN mkdir -p /opt/extensions -COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/ +FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/ RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh diff --git a/utils/build/docker/nodejs_lambda/nodejs-apigw-rest.Dockerfile b/utils/build/docker/nodejs_lambda/nodejs-apigw-rest.Dockerfile index 3175afcbc95..9b2bb60871c 100644 --- a/utils/build/docker/nodejs_lambda/nodejs-apigw-rest.Dockerfile +++ b/utils/build/docker/nodejs_lambda/nodejs-apigw-rest.Dockerfile @@ -1,10 +1,4 @@ -FROM public.ecr.aws/lambda/nodejs:18 - -RUN yum install -y unzip findutils socat && yum clean all - -# Add the Datadog Extension -RUN mkdir -p /opt/extensions -COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/ +FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/ RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh diff --git a/utils/build/docker/nodejs_lambda/nodejs-function-url.Dockerfile b/utils/build/docker/nodejs_lambda/nodejs-function-url.Dockerfile index bc4d8f97bc6..93defeadce9 100644 --- a/utils/build/docker/nodejs_lambda/nodejs-function-url.Dockerfile +++ b/utils/build/docker/nodejs_lambda/nodejs-function-url.Dockerfile @@ -1,10 +1,4 @@ -FROM public.ecr.aws/lambda/nodejs:18 - -RUN yum install -y unzip findutils socat && yum clean all - -# Add the Datadog Extension -RUN mkdir -p /opt/extensions -COPY --from=public.ecr.aws/datadog/lambda-extension:latest /opt/. /opt/ +FROM system_tests_base_nodejs_lambda_nodejs_lambda_runtime COPY utils/build/docker/nodejs_lambda/install_datadog_lambda.sh binaries* /binaries/ RUN chmod +x /binaries/install_datadog_lambda.sh && /binaries/install_datadog_lambda.sh diff --git a/utils/build/docker/nodejs_lambda/runtime.base.Dockerfile b/utils/build/docker/nodejs_lambda/runtime.base.Dockerfile new file mode 100644 index 00000000000..d7f4206233e --- /dev/null +++ b/utils/build/docker/nodejs_lambda/runtime.base.Dockerfile @@ -0,0 +1,10 @@ +FROM public.ecr.aws/lambda/nodejs:18 + +RUN yum install -y unzip findutils socat && yum clean all + +# Add the Datadog Extension +# Pinned (not :latest): the base-image content hash only covers local build-context +# files, so a floating tag would freeze silently on first build and never refresh. +# Bump this manually to pick up newer extension releases. +RUN mkdir -p /opt/extensions +COPY --from=public.ecr.aws/datadog/lambda-extension:100 /opt/. /opt/ From 3c3bf53cb4434fb86666a83886af7767be14eea1 Mon Sep 17 00:00:00 2001 From: Carles Capell Date: Wed, 30 Sep 2026 09:48:38 +0200 Subject: [PATCH 2/4] build(nodejs_lambda): lock the published runtime base image --- mirror_images.lock.yaml | 4 ++++ mirror_images.yaml | 1 + utils/build/docker/base-images.lock.json | 1 + 3 files changed, 6 insertions(+) diff --git a/mirror_images.lock.yaml b/mirror_images.lock.yaml index 70320f72e07..6e33fa4f80a 100644 --- a/mirror_images.lock.yaml +++ b/mirror_images.lock.yaml @@ -210,6 +210,10 @@ images: digest: sha256:128b7524cde00a739246166feef66b0d512388005dc125b0f11034555a8b6a70 target: registry.ddbuild.io/system-tests/mirror/datadog/system-tests:nextjs.base-95582a903467 tag: nextjs.base-95582a903467 + datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf: + digest: sha256:6f2d40e78bc96937010874e2b7f23ef9effb5e087c0cdf674f9b1ca0bcb631a8 + target: registry.ddbuild.io/system-tests/mirror/datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf + tag: nodejs-lambda-runtime.base-f7f78c7298cf datadog/system-tests:nodejs_buddy-v1: digest: sha256:71d124f74d4d7ac706f1afa8d5950864e1e931ec3b511f540b49eb6328c0338e target: registry.ddbuild.io/system-tests/mirror/datadog/system-tests:nodejs_buddy-v1 diff --git a/mirror_images.yaml b/mirror_images.yaml index 2b57e8babe1..0d5fcfce339 100644 --- a/mirror_images.yaml +++ b/mirror_images.yaml @@ -60,6 +60,7 @@ - "datadog/system-tests:java_buddy-v1" - "datadog/system-tests:lambda-proxy-v1" - "datadog/system-tests:nextjs.base-95582a903467" +- "datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf" - "datadog/system-tests:nodejs_buddy-v1" - "datadog/system-tests:php-fpm-7.0.base-137961f277f1" - "datadog/system-tests:php-fpm-7.0.base-d91477553f22" diff --git a/utils/build/docker/base-images.lock.json b/utils/build/docker/base-images.lock.json index 8e9a8ec468b..b97b75d18f5 100644 --- a/utils/build/docker/base-images.lock.json +++ b/utils/build/docker/base-images.lock.json @@ -5,6 +5,7 @@ "system_tests_base_nodejs_express4_typescript": "datadog/system-tests:express4-typescript.base-eb800c09d602", "system_tests_base_nodejs_express5": "datadog/system-tests:express5.base-3ef9e2c68c47", "system_tests_base_nodejs_fastify": "datadog/system-tests:fastify.base-bce27c61b3f5", + "system_tests_base_nodejs_lambda_nodejs_lambda_runtime": "datadog/system-tests:nodejs-lambda-runtime.base-f7f78c7298cf", "system_tests_base_nodejs_nextjs": "datadog/system-tests:nextjs.base-95582a903467", "system_tests_base_php_apache_mod_7_0": "datadog/system-tests:apache-mod-7.0.base-8c8102938177", "system_tests_base_php_apache_mod_7_0_zts": "datadog/system-tests:apache-mod-7.0-zts.base-01cc5715b403", From 54b4a42d1e4b8332b6ea1be658c6655f78190089 Mon Sep 17 00:00:00 2001 From: Carles Capell Date: Wed, 30 Sep 2026 10:48:50 +0200 Subject: [PATCH 3/4] fix(nodejs_lambda): stop hitting the GitHub API rate limit when resolving the latest release --- .../docker/nodejs_lambda/install_datadog_lambda.sh | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/utils/build/docker/nodejs_lambda/install_datadog_lambda.sh b/utils/build/docker/nodejs_lambda/install_datadog_lambda.sh index 7ecc43ac725..cb3a297d13d 100755 --- a/utils/build/docker/nodejs_lambda/install_datadog_lambda.sh +++ b/utils/build/docker/nodejs_lambda/install_datadog_lambda.sh @@ -22,13 +22,12 @@ else esac echo "Detected Node.js major: ${NODE_MAJOR}, using layer runtime version: ${NODE_VERSION}" - LATEST_TAG=$(curl -fsSL -H "Accept: application/vnd.github.v3+json" \ - https://api.github.com/repos/DataDog/datadog-lambda-js/releases/latest \ - | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"//;s/".*//') - echo "Latest release tag: ${LATEST_TAG}" - + # Resolves directly to the latest release's asset (a github.com redirect), unlike + # api.github.com/.../releases/latest which needs a separate call to get the tag name + # first and hits that API's much lower unauthenticated rate limit (60/hour/IP). + # python_lambda and ruby_lambda's install scripts use the same shortcut. ZIP_NAME="datadog_lambda_node${NODE_VERSION}.zip" - DOWNLOAD_URL="https://github.com/DataDog/datadog-lambda-js/releases/download/${LATEST_TAG}/${ZIP_NAME}" + DOWNLOAD_URL="https://github.com/DataDog/datadog-lambda-js/releases/latest/download/${ZIP_NAME}" echo "Downloading ${DOWNLOAD_URL}" curl -fsSLO "${DOWNLOAD_URL}" From 90fb68e57009d3f34939b9cd240394718a1415b4 Mon Sep 17 00:00:00 2001 From: Carles Capell Date: Thu, 1 Oct 2026 07:57:41 +0200 Subject: [PATCH 4/4] build(nodejs_lambda): auto-bump the pinned lambda-extension version --- .github/workflows/update-lambda-extension.yml | 3 ++- utils/scripts/update_lambda_extension_version.py | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/update-lambda-extension.yml b/.github/workflows/update-lambda-extension.yml index 3b0dde97c21..c62e39ad8c0 100644 --- a/.github/workflows/update-lambda-extension.yml +++ b/.github/workflows/update-lambda-extension.yml @@ -68,6 +68,7 @@ jobs: "utils/build/docker/python_lambda/runtime.base.Dockerfile" \ "utils/build/docker/java_lambda/runtime.base.Dockerfile" \ "utils/build/docker/ruby_lambda/runtime.base.Dockerfile" \ + "utils/build/docker/nodejs_lambda/runtime.base.Dockerfile" \ "utils/build/docker/base-images.lock.json" \ "mirror_images.yaml" \ "mirror_images.lock.yaml" \ @@ -129,7 +130,7 @@ jobs: else gh pr create \ --title "Update pinned lambda extension version" \ - --body "Automated update of the pinned public.ecr.aws/datadog/lambda-extension version used by the python_lambda, java_lambda, and ruby_lambda base images" \ + --body "Automated update of the pinned public.ecr.aws/datadog/lambda-extension version used by the python_lambda, java_lambda, ruby_lambda, and nodejs_lambda base images" \ --head "$BRANCH_NAME" \ --base main fi diff --git a/utils/scripts/update_lambda_extension_version.py b/utils/scripts/update_lambda_extension_version.py index 2bd9ed0fb3c..216b26ffe88 100755 --- a/utils/scripts/update_lambda_extension_version.py +++ b/utils/scripts/update_lambda_extension_version.py @@ -7,8 +7,8 @@ The extension is pinned (not `:latest`) because the base-image content hash only covers local build-context files: a floating tag would freeze silently on the image's first build and never refresh (see utils/build/docker/python_lambda/runtime.base.Dockerfile, -utils/build/docker/java_lambda/runtime.base.Dockerfile, and -utils/build/docker/ruby_lambda/runtime.base.Dockerfile). This script keeps that pin current. +utils/build/docker/java_lambda/runtime.base.Dockerfile, utils/build/docker/ruby_lambda/runtime.base.Dockerfile, +and utils/build/docker/nodejs_lambda/runtime.base.Dockerfile). This script keeps that pin current. """ import re @@ -22,6 +22,7 @@ REPO_ROOT / "utils" / "build" / "docker" / "python_lambda" / "runtime.base.Dockerfile", REPO_ROOT / "utils" / "build" / "docker" / "java_lambda" / "runtime.base.Dockerfile", REPO_ROOT / "utils" / "build" / "docker" / "ruby_lambda" / "runtime.base.Dockerfile", + REPO_ROOT / "utils" / "build" / "docker" / "nodejs_lambda" / "runtime.base.Dockerfile", ] REGISTRY = "public.ecr.aws"